Windows Analysis Report
MIpuuSiSZ4

Overview

General Information

Sample Name: MIpuuSiSZ4 (renamed file extension from none to dll)
Analysis ID: 671702
MD5: 1dd34935a785a419fb552b5086ea682e
SHA1: c6c966e4ba623f9972273de07b842ffbb9a9efce
SHA256: 8b5a10f9a8f2b25057442111a01faf021ef7e048eab875a4078a44758d952c6f
Tags: exeOpenCTIBRSandboxed
Infos:

Detection

Emotet
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Registers a DLL
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: MIpuuSiSZ4.dll Virustotal: Detection: 72% Perma Link
Source: MIpuuSiSZ4.dll Metadefender: Detection: 54% Perma Link
Source: MIpuuSiSZ4.dll ReversingLabs: Detection: 88%
Antivirus detection for URL or domain
Source: https://174.138.33.49/7 Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/temy Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/Numv Avira URL Cloud: Label: malware
Source: 0000000C.00000003.792258520.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["192.168.2.7:2", "244.26.0.0:1", "240.69.242.0:2", "184.6.0.0:1", "64.6.0.0:1", "192.6.0.0:1", "244.6.0.0:1", "4.7.0.0:1", "20.7.0.0:1", "76.7.0.0:1", "92.7.0.0:1", "108.7.0.0:1", "112.7.0.0:1", "200.6.0.0:1", "16.7.0.0:1", "96.7.0.0:1", "124.7.0.0:1", "80.7.0.0:1", "128.7.0.0:1", "240.6.0.0:1", "32.7.0.0:1", "36.7.0.0:1", "214.112.3.0:5308", "241.112.3.0:5164", "243.112.3.0:1484"]}
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180042F88 FindFirstFileExW, 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180042F88 FindFirstFileExW, 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0287C9F0 FindFirstFileW,FindNextFileW, 12_2_0287C9F0

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 174.138.33.49 7080 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.7:49794 -> 174.138.33.49:7080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 192.168.2.7:2
Source: Malware configuration extractor IPs: 244.26.0.0:1
Source: Malware configuration extractor IPs: 240.69.242.0:2
Source: Malware configuration extractor IPs: 184.6.0.0:1
Source: Malware configuration extractor IPs: 64.6.0.0:1
Source: Malware configuration extractor IPs: 192.6.0.0:1
Source: Malware configuration extractor IPs: 244.6.0.0:1
Source: Malware configuration extractor IPs: 4.7.0.0:1
Source: Malware configuration extractor IPs: 20.7.0.0:1
Source: Malware configuration extractor IPs: 76.7.0.0:1
Source: Malware configuration extractor IPs: 92.7.0.0:1
Source: Malware configuration extractor IPs: 108.7.0.0:1
Source: Malware configuration extractor IPs: 112.7.0.0:1
Source: Malware configuration extractor IPs: 200.6.0.0:1
Source: Malware configuration extractor IPs: 16.7.0.0:1
Source: Malware configuration extractor IPs: 96.7.0.0:1
Source: Malware configuration extractor IPs: 124.7.0.0:1
Source: Malware configuration extractor IPs: 80.7.0.0:1
Source: Malware configuration extractor IPs: 128.7.0.0:1
Source: Malware configuration extractor IPs: 240.6.0.0:1
Source: Malware configuration extractor IPs: 32.7.0.0:1
Source: Malware configuration extractor IPs: 36.7.0.0:1
Source: Malware configuration extractor IPs: 214.112.3.0:5308
Source: Malware configuration extractor IPs: 241.112.3.0:5164
Source: Malware configuration extractor IPs: 243.112.3.0:1484
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 174.138.33.49 174.138.33.49
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49794 -> 174.138.33.49:7080
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: regsvr32.exe, 0000000C.00000003.792258520.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.788408312.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.883040476.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.883963436.00000227B5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.740019918.0000014760705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000016.00000002.883963436.00000227B5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.739932682.000001475FCE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000C.00000003.792258520.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.788408312.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.883040476.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.12.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000C.00000003.563716950.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ba3f020901819
Source: regsvr32.exe, 0000000C.00000003.565719065.000000000300D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.883662137.000000000302C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.565412953.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.565930872.000000000302C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.caby
Source: svchost.exe, 0000001E.00000003.714545443.00000147607A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000016.00000002.883340069.00000227AF8AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49/
Source: regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49/7
Source: regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/
Source: regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/Numv
Source: regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/temy
Source: svchost.exe, 0000001E.00000003.714545443.00000147607A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000001E.00000003.710986823.0000014760C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710810502.0000014760C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710861874.0000014760C03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710944641.00000147607AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710923120.000001476079C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 0000001E.00000003.714545443.00000147607A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001E.00000003.714545443.00000147607A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001E.00000003.710986823.0000014760C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710810502.0000014760C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710861874.0000014760C03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710944641.00000147607AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710923120.000001476079C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 0000001E.00000003.710986823.0000014760C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710810502.0000014760C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710861874.0000014760C03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710944641.00000147607AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.710923120.000001476079C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 0000001E.00000003.719101021.00000147607A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.718967987.00000147607B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.719233278.0000014760C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.718937080.00000147607B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.tiktok.com/legal/report/feedback

E-Banking Fraud
barindex
Source: Yara match File source: 0000000C.00000002.882519844.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Emotet
Source: Yara match File source: 3.2.rundll32.exe.1a6c08b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.195c5870000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.1000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.21313760000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.1a6c08b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.1942a5d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.16a80010000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.16a80010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.195c5870000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.regsvr32.exe.13b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.1942a5d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.regsvr32.exe.13b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.21313760000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.457523835.000001A6C0911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454942955.0000000001411000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.460329273.0000016A80010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.500443188.000001A6C0911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.883306468.0000000001000000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.503233757.0000021313901000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.460399040.0000016A80071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.883481925.0000000002861000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.499993940.000001A6C08B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.488615007.000001942A671000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.458204040.0000021313901000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.468293754.00000195C58D1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.457983091.0000021313760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.457466014.000001A6C08B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454887422.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.448855621.000001A6C0911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.454361313.0000021313901000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.448792384.000001A6C08B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.468234789.00000195C5870000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.454167344.0000021313760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.503043476.0000021313760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.488528971.000001942A5D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 484 -p 6160 -ip 6160
Deletes files inside the Windows folder
Source: C:\Windows\System32\regsvr32.exe File deleted: C:\Windows\System32\FmCnbLJkOlaRytmc\QMbXoKRooU.dll:Zone.Identifier Jump to behavior
Creates files inside the system directory
Source: C:\Windows\System32\loaddll64.exe File created: C:\Windows\system32\YbTPHZsAWIZFUi\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A098 0_2_000000018001A098
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003E0D0 0_2_000000018003E0D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800180E0 0_2_00000001800180E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C0F4 0_2_000000018001C0F4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E134 0_2_000000018001E134
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C150 0_2_000000018002C150
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A1A0 0_2_000000018001A1A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004E1C0 0_2_000000018004E1C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800181E4 0_2_00000001800181E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026288 0_2_0000000180026288
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A2A8 0_2_000000018001A2A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800182E8 0_2_00000001800182E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E320 0_2_000000018001E320
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C324 0_2_000000018001C324
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180058338 0_2_0000000180058338
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A3B4 0_2_000000018001A3B4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800063E0 0_2_00000001800063E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800183F0 0_2_00000001800183F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002E420 0_2_000000018002E420
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E508 0_2_000000018001E508
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C510 0_2_000000018001C510
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180028514 0_2_0000000180028514
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C51C 0_2_000000018002C51C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018548 0_2_0000000180018548
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018005A5A4 0_2_000000018005A5A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026618 0_2_0000000180026618
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018650 0_2_0000000180018650
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180028668 0_2_0000000180028668
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004067C 0_2_000000018004067C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004E6F0 0_2_000000018004E6F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C6FC 0_2_000000018001C6FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E734 0_2_000000018001E734
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018758 0_2_0000000180018758
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800287E4 0_2_00000001800287E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018860 0_2_0000000180018860
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016870 0_2_0000000180016870
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800548F8 0_2_00000001800548F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C900 0_2_000000018002C900
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E91C 0_2_000000018001E91C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C92C 0_2_000000018001C92C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016978 0_2_0000000180016978
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800189CC 0_2_00000001800189CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026A24 0_2_0000000180026A24
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016A80 0_2_0000000180016A80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001EB04 0_2_000000018001EB04
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018B10 0_2_0000000180018B10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001CB18 0_2_000000018001CB18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016B8C 0_2_0000000180016B8C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004EBA0 0_2_000000018004EBA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018C54 0_2_0000000180018C54
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002CCCC 0_2_000000018002CCCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016CE8 0_2_0000000180016CE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001CD00 0_2_000000018001CD00
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001ED30 0_2_000000018001ED30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018D98 0_2_0000000180018D98
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016DF0 0_2_0000000180016DF0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004CEC8 0_2_000000018004CEC8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018EC8 0_2_0000000180018EC8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016EF8 0_2_0000000180016EF8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001EF18 0_2_000000018001EF18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001CF2C 0_2_000000018001CF2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180042F88 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018FD0 0_2_0000000180018FD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017000 0_2_0000000180017000
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800190D8 0_2_00000001800190D8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F104 0_2_000000018001F104
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D114 0_2_000000018001D114
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017158 0_2_0000000180017158
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002D19C 0_2_000000018002D19C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800191E0 0_2_00000001800191E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017260 0_2_0000000180017260
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D2FC 0_2_000000018001D2FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004F2FC 0_2_000000018004F2FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B310 0_2_000000018001B310
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F334 0_2_000000018001F334
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019338 0_2_0000000180019338
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017368 0_2_0000000180017368
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019440 0_2_0000000180019440
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017474 0_2_0000000180017474
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002B49C 0_2_000000018002B49C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B4F8 0_2_000000018001B4F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F520 0_2_000000018001F520
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D528 0_2_000000018001D528
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019548 0_2_0000000180019548
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800175D0 0_2_00000001800175D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019650 0_2_0000000180019650
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002D680 0_2_000000018002D680
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800176D4 0_2_00000001800176D4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F70C 0_2_000000018001F70C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D710 0_2_000000018001D710
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B724 0_2_000000018001B724
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004972C 0_2_000000018004972C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025740 0_2_0000000180025740
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800197B8 0_2_00000001800197B8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004B7E8 0_2_000000018004B7E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017800 0_2_0000000180017800
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800198C0 0_2_00000001800198C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002B8D0 0_2_000000018002B8D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D8FC 0_2_000000018001D8FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017908 0_2_0000000180017908
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B90C 0_2_000000018001B90C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F93C 0_2_000000018001F93C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800199C8 0_2_00000001800199C8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017A10 0_2_0000000180017A10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003FA6C 0_2_000000018003FA6C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180045A70 0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019AD0 0_2_0000000180019AD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025AD4 0_2_0000000180025AD4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BAF4 0_2_000000018001BAF4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017B18 0_2_0000000180017B18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001DB2C 0_2_000000018001DB2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002DB50 0_2_000000018002DB50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019C28 0_2_0000000180019C28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017C70 0_2_0000000180017C70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003BD00 0_2_000000018003BD00
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001DD18 0_2_000000018001DD18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002BD1C 0_2_000000018002BD1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BD20 0_2_000000018001BD20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019D30 0_2_0000000180019D30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017D78 0_2_0000000180017D78
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180045A70 0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019E38 0_2_0000000180019E38
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017E80 0_2_0000000180017E80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180049EEC 0_2_0000000180049EEC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025EFC 0_2_0000000180025EFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001DF04 0_2_000000018001DF04
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BF08 0_2_000000018001BF08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003FF1C 0_2_000000018003FF1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019F40 0_2_0000000180019F40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017F88 0_2_0000000180017F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002DFAC 0_2_000000018002DFAC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000019428C20000 0_2_0000019428C20000
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68EB08 0_2_000001942A68EB08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68A804 0_2_000001942A68A804
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68BD64 0_2_000001942A68BD64
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A697E28 0_2_000001942A697E28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A681B88 0_2_000001942A681B88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A688B3C 0_2_000001942A688B3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A675B18 0_2_000001942A675B18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68FC70 0_2_000001942A68FC70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67CCC8 0_2_000001942A67CCC8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69B6BC 0_2_000001942A69B6BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A687414 0_2_000001942A687414
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A686978 0_2_000001942A686978
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A698990 0_2_000001942A698990
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69796C 0_2_000001942A69796C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69093C 0_2_000001942A69093C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A674948 0_2_000001942A674948
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A694918 0_2_000001942A694918
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67D92C 0_2_000001942A67D92C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6899F4 0_2_000001942A6899F4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68C9F0 0_2_000001942A68C9F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6829BC 0_2_000001942A6829BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68D9C4 0_2_000001942A68D9C4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A699A40 0_2_000001942A699A40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A692AFC 0_2_000001942A692AFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A691AE0 0_2_000001942A691AE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A672AE4 0_2_000001942A672AE4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67FAD0 0_2_000001942A67FAD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A690AC4 0_2_000001942A690AC4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A673A9C 0_2_000001942A673A9C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68F764 0_2_000001942A68F764
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A689720 0_2_000001942A689720
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68C720 0_2_000001942A68C720
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A683724 0_2_000001942A683724
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6907D0 0_2_000001942A6907D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6827A4 0_2_000001942A6827A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68E7A4 0_2_000001942A68E7A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68484C 0_2_000001942A68484C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A674848 0_2_000001942A674848
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67F850 0_2_000001942A67F850
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A672820 0_2_000001942A672820
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68C8C0 0_2_000001942A68C8C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6878C4 0_2_000001942A6878C4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A693894 0_2_000001942A693894
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67ED84 0_2_000001942A67ED84
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A689D5C 0_2_000001942A689D5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A683D1C 0_2_000001942A683D1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69BD20 0_2_000001942A69BD20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A691D2C 0_2_000001942A691D2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67BD24 0_2_000001942A67BD24
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A692E04 0_2_000001942A692E04
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A693DD4 0_2_000001942A693DD4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A690DBC 0_2_000001942A690DBC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A672DC0 0_2_000001942A672DC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A687DB0 0_2_000001942A687DB0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A699DA8 0_2_000001942A699DA8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69BE90 0_2_000001942A69BE90
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68EE5C 0_2_000001942A68EE5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67FE58 0_2_000001942A67FE58
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A683E18 0_2_000001942A683E18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A695E30 0_2_000001942A695E30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A694EF4 0_2_000001942A694EF4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A698EE8 0_2_000001942A698EE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A689EC0 0_2_000001942A689EC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67DB74 0_2_000001942A67DB74
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A680B60 0_2_000001942A680B60
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67CB6C 0_2_000001942A67CB6C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A696B40 0_2_000001942A696B40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A687B24 0_2_000001942A687B24
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A698B28 0_2_000001942A698B28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67BC08 0_2_000001942A67BC08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68ABD8 0_2_000001942A68ABD8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A677BB4 0_2_000001942A677BB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A683BB4 0_2_000001942A683BB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A674C64 0_2_000001942A674C64
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A680C68 0_2_000001942A680C68
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A690C68 0_2_000001942A690C68
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A685C50 0_2_000001942A685C50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A692C48 0_2_000001942A692C48
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A687C30 0_2_000001942A687C30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A678CE0 0_2_000001942A678CE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68ACEC 0_2_000001942A68ACEC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A673CE8 0_2_000001942A673CE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A677CAC 0_2_000001942A677CAC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A687144 0_2_000001942A687144
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68A130 0_2_000001942A68A130
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A683210 0_2_000001942A683210
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6731F0 0_2_000001942A6731F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A675198 0_2_000001942A675198
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6741A8 0_2_000001942A6741A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67B1A8 0_2_000001942A67B1A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67F290 0_2_000001942A67F290
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67E254 0_2_000001942A67E254
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68D254 0_2_000001942A68D254
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68F238 0_2_000001942A68F238
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6912FC 0_2_000001942A6912FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67D300 0_2_000001942A67D300
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69A304 0_2_000001942A69A304
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A693304 0_2_000001942A693304
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6772E0 0_2_000001942A6772E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67B2BC 0_2_000001942A67B2BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A678F5C 0_2_000001942A678F5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A692F3C 0_2_000001942A692F3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A696F3C 0_2_000001942A696F3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A673F40 0_2_000001942A673F40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67AFE4 0_2_000001942A67AFE4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67DFCC 0_2_000001942A67DFCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67EFCC 0_2_000001942A67EFCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A682F94 0_2_000001942A682F94
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68EFAC 0_2_000001942A68EFAC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A674078 0_2_000001942A674078
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69A088 0_2_000001942A69A088
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68406C 0_2_000001942A68406C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A694020 0_2_000001942A694020
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A671014 0_2_000001942A671014
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68B028 0_2_000001942A68B028
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67B0F8 0_2_000001942A67B0F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A686110 0_2_000001942A686110
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6790D4 0_2_000001942A6790D4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69B0EC 0_2_000001942A69B0EC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6730BC 0_2_000001942A6730BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67F580 0_2_000001942A67F580
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A680578 0_2_000001942A680578
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69155C 0_2_000001942A69155C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68B558 0_2_000001942A68B558
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69B570 0_2_000001942A69B570
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A696520 0_2_000001942A696520
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A683610 0_2_000001942A683610
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6725D8 0_2_000001942A6725D8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A684594 0_2_000001942A684594
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A686594 0_2_000001942A686594
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68C5AC 0_2_000001942A68C5AC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A680680 0_2_000001942A680680
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A692638 0_2_000001942A692638
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68F61C 0_2_000001942A68F61C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68D620 0_2_000001942A68D620
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68762C 0_2_000001942A68762C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A672708 0_2_000001942A672708
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6736E0 0_2_000001942A6736E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6846B4 0_2_000001942A6846B4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69369C 0_2_000001942A69369C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67B698 0_2_000001942A67B698
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A676698 0_2_000001942A676698
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6976A4 0_2_000001942A6976A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6916A8 0_2_000001942A6916A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A671368 0_2_000001942A671368
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A684368 0_2_000001942A684368
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69632C 0_2_000001942A69632C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A694330 0_2_000001942A694330
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6913FC 0_2_000001942A6913FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68A408 0_2_000001942A68A408
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6893E0 0_2_000001942A6893E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67B3E4 0_2_000001942A67B3E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6793AC 0_2_000001942A6793AC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A675484 0_2_000001942A675484
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A67C458 0_2_000001942A67C458
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A69344C 0_2_000001942A69344C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A686418 0_2_000001942A686418
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6984DC 0_2_000001942A6984DC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6824E4 0_2_000001942A6824E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68D4D0 0_2_000001942A68D4D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A6814A0 0_2_000001942A6814A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68E4A8 0_2_000001942A68E4A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A098 2_2_000000018001A098
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003E0D0 2_2_000000018003E0D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800180E0 2_2_00000001800180E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C0F4 2_2_000000018001C0F4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E134 2_2_000000018001E134
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002C150 2_2_000000018002C150
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A1A0 2_2_000000018001A1A0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004E1C0 2_2_000000018004E1C0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800181E4 2_2_00000001800181E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180026288 2_2_0000000180026288
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A2A8 2_2_000000018001A2A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800182E8 2_2_00000001800182E8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E320 2_2_000000018001E320
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C324 2_2_000000018001C324
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180058338 2_2_0000000180058338
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A3B4 2_2_000000018001A3B4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800063E0 2_2_00000001800063E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800183F0 2_2_00000001800183F0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002E420 2_2_000000018002E420
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E508 2_2_000000018001E508
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C510 2_2_000000018001C510
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180028514 2_2_0000000180028514
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002C51C 2_2_000000018002C51C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018548 2_2_0000000180018548
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018005A5A4 2_2_000000018005A5A4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180026618 2_2_0000000180026618
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018650 2_2_0000000180018650
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180028668 2_2_0000000180028668
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004067C 2_2_000000018004067C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004E6F0 2_2_000000018004E6F0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C6FC 2_2_000000018001C6FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E734 2_2_000000018001E734
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018758 2_2_0000000180018758
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800287E4 2_2_00000001800287E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018860 2_2_0000000180018860
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016870 2_2_0000000180016870
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800548F8 2_2_00000001800548F8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002C900 2_2_000000018002C900
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E91C 2_2_000000018001E91C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C92C 2_2_000000018001C92C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016978 2_2_0000000180016978
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800189CC 2_2_00000001800189CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180026A24 2_2_0000000180026A24
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016A80 2_2_0000000180016A80
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001EB04 2_2_000000018001EB04
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018B10 2_2_0000000180018B10
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001CB18 2_2_000000018001CB18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016B8C 2_2_0000000180016B8C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004EBA0 2_2_000000018004EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018C54 2_2_0000000180018C54
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002CCCC 2_2_000000018002CCCC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016CE8 2_2_0000000180016CE8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001CD00 2_2_000000018001CD00
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001ED30 2_2_000000018001ED30
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018D98 2_2_0000000180018D98
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016DF0 2_2_0000000180016DF0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004CEC8 2_2_000000018004CEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018EC8 2_2_0000000180018EC8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016EF8 2_2_0000000180016EF8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001EF18 2_2_000000018001EF18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001CF2C 2_2_000000018001CF2C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180042F88 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018FD0 2_2_0000000180018FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017000 2_2_0000000180017000
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800190D8 2_2_00000001800190D8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F104 2_2_000000018001F104
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D114 2_2_000000018001D114
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017158 2_2_0000000180017158
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002D19C 2_2_000000018002D19C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800191E0 2_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017260 2_2_0000000180017260
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D2FC 2_2_000000018001D2FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004F2FC 2_2_000000018004F2FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B310 2_2_000000018001B310
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F334 2_2_000000018001F334
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019338 2_2_0000000180019338
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017368 2_2_0000000180017368
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019440 2_2_0000000180019440
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017474 2_2_0000000180017474
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002B49C 2_2_000000018002B49C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B4F8 2_2_000000018001B4F8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F520 2_2_000000018001F520
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D528 2_2_000000018001D528
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019548 2_2_0000000180019548
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800175D0 2_2_00000001800175D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019650 2_2_0000000180019650
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002D680 2_2_000000018002D680
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800176D4 2_2_00000001800176D4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F70C 2_2_000000018001F70C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D710 2_2_000000018001D710
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B724 2_2_000000018001B724
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004972C 2_2_000000018004972C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180025740 2_2_0000000180025740
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800197B8 2_2_00000001800197B8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004B7E8 2_2_000000018004B7E8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017800 2_2_0000000180017800
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800198C0 2_2_00000001800198C0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002B8D0 2_2_000000018002B8D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D8FC 2_2_000000018001D8FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017908 2_2_0000000180017908
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B90C 2_2_000000018001B90C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F93C 2_2_000000018001F93C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800199C8 2_2_00000001800199C8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017A10 2_2_0000000180017A10
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003FA6C 2_2_000000018003FA6C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180045A70 2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019AD0 2_2_0000000180019AD0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180025AD4 2_2_0000000180025AD4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001BAF4 2_2_000000018001BAF4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017B18 2_2_0000000180017B18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001DB2C 2_2_000000018001DB2C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002DB50 2_2_000000018002DB50
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019C28 2_2_0000000180019C28
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017C70 2_2_0000000180017C70
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003BD00 2_2_000000018003BD00
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001DD18 2_2_000000018001DD18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002BD1C 2_2_000000018002BD1C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001BD20 2_2_000000018001BD20
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019D30 2_2_0000000180019D30
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017D78 2_2_0000000180017D78
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180045A70 2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019E38 2_2_0000000180019E38
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017E80 2_2_0000000180017E80
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180049EEC 2_2_0000000180049EEC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180025EFC 2_2_0000000180025EFC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001DF04 2_2_000000018001DF04
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001BF08 2_2_000000018001BF08
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003FF1C 2_2_000000018003FF1C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019F40 2_2_0000000180019F40
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017F88 2_2_0000000180017F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002DFAC 2_2_000000018002DFAC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01240000 2_2_01240000
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01427414 2_2_01427414
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143B6BC 2_2_0143B6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142A804 2_2_0142A804
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142C8C0 2_2_0142C8C0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142EB08 2_2_0142EB08
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01415B18 2_2_01415B18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01428B3C 2_2_01428B3C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01421B88 2_2_01421B88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142BD64 2_2_0142BD64
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141CCC8 2_2_0141CCC8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01437E28 2_2_01437E28
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01427144 2_2_01427144
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01426110 2_2_01426110
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142A130 2_2_0142A130
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014131F0 2_2_014131F0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01415198 2_2_01415198
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014141A8 2_2_014141A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141B1A8 2_2_0141B1A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142406C 2_2_0142406C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01414078 2_2_01414078
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01411014 2_2_01411014
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01434020 2_2_01434020
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142B028 2_2_0142B028
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014190D4 2_2_014190D4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143B0EC 2_2_0143B0EC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141B0F8 2_2_0141B0F8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143A088 2_2_0143A088
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014130BC 2_2_014130BC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01411368 2_2_01411368
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01424368 2_2_01424368
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141D300 2_2_0141D300
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143A304 2_2_0143A304
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01433304 2_2_01433304
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143632C 2_2_0143632C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01434330 2_2_01434330
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014293E0 2_2_014293E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141B3E4 2_2_0141B3E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014313FC 2_2_014313FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014193AC 2_2_014193AC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141E254 2_2_0141E254
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142D254 2_2_0142D254
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01423210 2_2_01423210
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142F238 2_2_0142F238
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014172E0 2_2_014172E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014312FC 2_2_014312FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141F290 2_2_0141F290
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141B2BC 2_2_0141B2BC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142B558 2_2_0142B558
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143155C 2_2_0143155C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143B570 2_2_0143B570
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01420578 2_2_01420578
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01436520 2_2_01436520
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014125D8 2_2_014125D8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141F580 2_2_0141F580
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01424594 2_2_01424594
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01426594 2_2_01426594
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142C5AC 2_2_0142C5AC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0143344C 2_2_0143344C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0141C458 2_2_0141C458
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142A408 2_2_0142A408
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01426418 2_2_01426418
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142D4D0 2_2_0142D4D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014384DC 2_2_014384DC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014224E4 2_2_014224E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01415484 2_2_01415484
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_014214A0 2_2_014214A0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142E4A8 2_2_0142E4A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0142F764 2_2_0142F764
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01412708 2_2_01412708
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01429720 2_2_01429720
Found potential string decryption / allocating functions
Source: C:\Windows\System32\loaddll64.exe Code function: String function: 0000000180046D38 appears 44 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 0000000180046D38 appears 44 times
Tries to load missing DLLs
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: MIpuuSiSZ4.dll Virustotal: Detection: 72%
Source: MIpuuSiSZ4.dll Metadefender: Detection: 54%
Source: MIpuuSiSZ4.dll ReversingLabs: Detection: 88%
Source: MIpuuSiSZ4.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 484 -p 6160 -ip 6160
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FmCnbLJkOlaRytmc\QMbXoKRooU.dll"
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 516 -p 3896 -ip 3896
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6160 -s 336
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3896 -s 328
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YbTPHZsAWIZFUi\eAeQcUPg.dll"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YbTPHZsAWIZFUi\eAeQcUPg.dll" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FmCnbLJkOlaRytmc\QMbXoKRooU.dll" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 484 -p 6160 -ip 6160 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 516 -p 3896 -ip 3896 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6160 -s 336 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3896 -s 328 Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB89A.tmp Jump to behavior
Source: classification engine Classification label: mal96.troj.evad.winDLL@34/16@0/28
Source: C:\Windows\System32\loaddll64.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A68A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,FindCloseChangeNotification, 0_2_000001942A68A804
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6160
Source: C:\Windows\System32\WerFault.exe Mutant created: \BaseNamedObjects\Local\SM0:6496:120:WilError_01
Source: C:\Windows\System32\WerFault.exe Mutant created: \BaseNamedObjects\Local\SM0:6568:120:WilError_01
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3896
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800011AC LoadStringW,LoadStringW,FindResourceA,LoadResource,LockResource, 0_2_00000001800011AC
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: MIpuuSiSZ4.dll Static PE information: Image base 0x180000000 > 0x60000000
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001942A678C72 push ebp; ret 0_2_000001942A678C7D
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_01418C72 push ebp; ret 2_2_01418C7D
PE file contains sections with non-standard names
Source: MIpuuSiSZ4.dll Static PE information: section name: _RDATA
Registers a DLL
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe PE file moved: C:\Windows\System32\FmCnbLJkOlaRytmc\QMbXoKRooU.dll Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\loaddll64.exe File opened: C:\Windows\system32\YbTPHZsAWIZFUi\eAeQcUPg.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\FmCnbLJkOlaRytmc\QMbXoKRooU.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 2240 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3160 Thread sleep time: -120000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\loaddll64.exe API coverage: 7.1 %
Source: C:\Windows\System32\regsvr32.exe API coverage: 7.4 %
Source: C:\Windows\System32\loaddll64.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180042F88 FindFirstFileExW, 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180042F88 FindFirstFileExW, 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0287C9F0 FindFirstFileW,FindNextFileW, 12_2_0287C9F0
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: svchost.exe, 00000016.00000002.883963436.00000227B5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.739954619.000001475FCF3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: @Hyper-V RAW
Source: regsvr32.exe, 0000000C.00000003.792566060.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.792402869.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882736405.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882901644.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.882944619.00000227AF829000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.883925272.00000227B504C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.739774338.000001475FC66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.739198935.000001475FC64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.739932682.000001475FCE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.882587569.0000023C76802000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: regsvr32.exe, 0000000C.00000003.792566060.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.882901644.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWj
Source: loaddll64.exe, 00000000.00000002.488486061.0000019428C98000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000002.882727598.0000023C76828000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000000018001360C
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180048198 GetProcessHeap, 0_2_0000000180048198
Checks if the current process is being debugged
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0000000180002F14
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000000018001360C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000000018000386C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003A54 SetUnhandledExceptionFilter, 0_2_0000000180003A54
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_0000000180002F14
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_000000018001360C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_000000018000386C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180003A54 SetUnhandledExceptionFilter, 2_2_0000000180003A54

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 174.138.33.49 7080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 484 -p 6160 -ip 6160 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 516 -p 3896 -ip 3896 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6160 -s 336 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3896 -s 328 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_000000018004C150
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_000000018004C1D4
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_000000018004C2A4
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_000000018004C364
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_000000018004C5B0
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_0000000180046664
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_000000018004C708
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_0000000180046788
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_000000018004C7DC
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_0000000180046810
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_000000018004C908
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_00000001800475F0
Source: C:\Windows\System32\loaddll64.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_000000018004BE04
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_000000018004C150
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_000000018004C1D4
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_000000018004C2A4
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 2_2_000000018004C364
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 2_2_000000018004C5B0
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_0000000180046664
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 2_2_000000018004C708
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_0000000180046788
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 2_2_000000018004C7DC
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_0000000180046810
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 2_2_000000018004C908
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 2_2_00000001800475F0
Source: C:\Windows\System32\regsvr32.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 2_2_000000018004BE04
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180059100 cpuid 0_2_0000000180059100
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800032C0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00000001800032C0

Stealing of Sensitive Information
barindex
Source: Yara match File source: 0000000C.00000002.882519844.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Emotet
Source: Yara match File source: 3.2.rundll32.exe.1a6c08b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.195c5870000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.1000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.21313760000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.1a6c08b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.1942a5d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.16a80010000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.16a80010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.195c5870000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.regsvr32.exe.13b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.1a6c08b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.1942a5d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.regsvr32.exe.13b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.21313760000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.21313760000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.457523835.000001A6C0911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454942955.0000000001411000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.460329273.0000016A80010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.500443188.000001A6C0911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.883306468.0000000001000000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.503233757.0000021313901000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.460399040.0000016A80071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.883481925.0000000002861000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.499993940.000001A6C08B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.488615007.000001942A671000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.458204040.0000021313901000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.468293754.00000195C58D1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.457983091.0000021313760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.457466014.000001A6C08B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454887422.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.448855621.000001A6C0911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.454361313.0000021313901000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.448792384.000001A6C08B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.468234789.00000195C5870000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.454167344.0000021313760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.503043476.0000021313760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.488528971.000001942A5D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 671702 Sample: MIpuuSiSZ4 Startdate: 22/07/2022 Architecture: WINDOWS Score: 96 44 200.6.0.0 UninetSAdeCVMX Ecuador 2->44 46 108.7.0.0 UUNETUS United States 2->46 48 23 other IPs or domains 2->48 56 Snort IDS alert for network traffic 2->56 58 Antivirus detection for URL or domain 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 3 other signatures 2->62 9 loaddll64.exe 3 2->9         started        12 svchost.exe 8 2->12         started        14 svchost.exe 9 1 2->14         started        17 5 other processes 2->17 signatures3 process4 dnsIp5 66 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->66 19 regsvr32.exe 5 9->19         started        22 cmd.exe 1 9->22         started        24 rundll32.exe 9->24         started        30 3 other processes 9->30 26 WerFault.exe 12->26         started        28 WerFault.exe 12->28         started        50 127.0.0.1 unknown unknown 14->50 52 192.168.2.1 unknown unknown 17->52 signatures6 process7 signatures8 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->64 32 regsvr32.exe 19->32         started        36 rundll32.exe 22->36         started        38 WerFault.exe 9 24->38         started        process9 dnsIp10 42 174.138.33.49, 49794, 7080 DIGITALOCEAN-ASNUS United States 32->42 54 System process connects to network (likely due to code injection or exploit) 32->54 40 WerFault.exe 20 9 36->40         started        signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
32.7.0.0
 unknown United States
2686 ATGS-MMD-ASUS true
174.138.33.49
 unknown United States
14061 DIGITALOCEAN-ASNUS true
128.7.0.0
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese true
20.7.0.0
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS true
108.7.0.0
 unknown United States
701 UUNETUS true
80.7.0.0
 unknown United Kingdom
5089 NTLGB true
92.7.0.0
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB true
244.6.0.0
 unknown Reserved
unknown unknown true
240.69.242.0
 unknown Reserved
unknown unknown true
184.6.0.0
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS true
192.6.0.0
 unknown United States
54735 TTGSIUS true
112.7.0.0
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany true
64.6.0.0
 unknown United States
14363 MTCCOMMUS true
214.112.3.0
 unknown United States
721 DNIC-ASBLK-00721-00726US true
4.7.0.0
 unknown United States
3356 LEVEL3US true
76.7.0.0
 unknown United States
22186 CENTURYLINK-LEGACY-EMBARQ-KSGRNRUS true
96.7.0.0
 unknown United States
262589 INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR true
240.6.0.0
 unknown Reserved
unknown unknown true
243.112.3.0
 unknown Reserved
unknown unknown true
200.6.0.0
 unknown Ecuador
8151 UninetSAdeCVMX true
241.112.3.0
 unknown Reserved
unknown unknown true
124.7.0.0
 unknown India
4662 QTCN-ASN1GCNetReachRangeIncTW true
16.7.0.0
 unknown United States
unknown unknown true
36.7.0.0
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN true
244.26.0.0
 unknown Reserved
unknown unknown true

Private

IP
192.168.2.1
192.168.2.7
127.0.0.1