Windows Analysis Report
MIpuuSiSZ4.dll

Overview

General Information

Sample Name: MIpuuSiSZ4.dll
Analysis ID: 671702
MD5: 1dd34935a785a419fb552b5086ea682e
SHA1: c6c966e4ba623f9972273de07b842ffbb9a9efce
SHA256: 8b5a10f9a8f2b25057442111a01faf021ef7e048eab875a4078a44758d952c6f
Tags: exeOpenCTIBRSandboxed
Infos:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Changes security center settings (notifications, updates, antivirus, firewall)
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to enumerate running services
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
AV process strings found (often used to terminate AV products)
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Registers a DLL
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: MIpuuSiSZ4.dll Virustotal: Detection: 72% Perma Link
Source: MIpuuSiSZ4.dll Metadefender: Detection: 54% Perma Link
Source: MIpuuSiSZ4.dll ReversingLabs: Detection: 88%
Antivirus detection for URL or domain
Source: https://174.138.33.49:7080/x Avira URL Cloud: Label: malware
Source: https://174.138.33.49/T Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/tem URL Reputation: Label: malware
Source: https://174.138.33.49:7080/944 Avira URL Cloud: Label: malware
Source: 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["101.69.85.108:20", "200.18.0.0:1", "208.9.0.0:2512", "82.10.0.0:2642", "144.1.49.1:2", "20.7.0.0:1", "176.6.0.0:1", "232.6.0.0:1", "136.6.0.0:1", "24.7.0.0:1", "248.6.0.0:1", "68.7.0.0:1", "80.7.0.0:1", "172.6.0.0:1", "96.7.0.0:1", "84.7.0.0:1", "4.7.0.0:1", "100.7.0.0:1", "112.7.0.0:1", "116.7.0.0:1", "180.6.0.0:1", "8.7.0.0:1", "236.6.0.0:1", "64.7.0.0:1", "204.6.0.0:1"]}
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180042F88 FindFirstFileExW, 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180042F88 FindFirstFileExW, 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02D2C9F0 FindFirstFileW,FindNextFileW, 12_2_02D2C9F0

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 174.138.33.49 7080 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.7:49794 -> 174.138.33.49:7080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 101.69.85.108:20
Source: Malware configuration extractor IPs: 200.18.0.0:1
Source: Malware configuration extractor IPs: 208.9.0.0:2512
Source: Malware configuration extractor IPs: 82.10.0.0:2642
Source: Malware configuration extractor IPs: 144.1.49.1:2
Source: Malware configuration extractor IPs: 20.7.0.0:1
Source: Malware configuration extractor IPs: 176.6.0.0:1
Source: Malware configuration extractor IPs: 232.6.0.0:1
Source: Malware configuration extractor IPs: 136.6.0.0:1
Source: Malware configuration extractor IPs: 24.7.0.0:1
Source: Malware configuration extractor IPs: 248.6.0.0:1
Source: Malware configuration extractor IPs: 68.7.0.0:1
Source: Malware configuration extractor IPs: 80.7.0.0:1
Source: Malware configuration extractor IPs: 172.6.0.0:1
Source: Malware configuration extractor IPs: 96.7.0.0:1
Source: Malware configuration extractor IPs: 84.7.0.0:1
Source: Malware configuration extractor IPs: 4.7.0.0:1
Source: Malware configuration extractor IPs: 100.7.0.0:1
Source: Malware configuration extractor IPs: 112.7.0.0:1
Source: Malware configuration extractor IPs: 116.7.0.0:1
Source: Malware configuration extractor IPs: 180.6.0.0:1
Source: Malware configuration extractor IPs: 8.7.0.0:1
Source: Malware configuration extractor IPs: 236.6.0.0:1
Source: Malware configuration extractor IPs: 64.7.0.0:1
Source: Malware configuration extractor IPs: 204.6.0.0:1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 174.138.33.49 174.138.33.49
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49761 -> 174.138.33.49:7080
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.605830890.00000298A2784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z||.||b7e2ac48-308b-4ab0-ad70-c01dd95863e0||1152921505695074449||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.605830890.00000298A2784000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z||.||b7e2ac48-308b-4ab0-ad70-c01dd95863e0||1152921505695074449||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649942559.00000298A2711000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.662502712.000000000136D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445329795.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.12.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000C.00000003.443936950.000000000138D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445018013.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.663236738.000000000350D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445267551.000000000350D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445153458.00000000034E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e0707f5d6733f
Source: regsvr32.exe, 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabvH
Source: regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/pXX
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.come
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49/
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49/T
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/944
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/tem
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://174.138.33.49:7080/x
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000012.00000002.405466984.000002D97084E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405005326.000002D970845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405447191.000002D97083A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000020.00000003.629383351.00000298A279F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.tiktok.com/legal/report/feedback

E-Banking Fraud
barindex
Source: Yara match File source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Emotet
Source: Yara match File source: 2.2.regsvr32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.20000010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.1a029ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.1a029ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.20000010000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.regsvr32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.15738060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.15738060000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
One or more processes crash
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6776 -s 324
Deletes files inside the Windows folder
Source: C:\Windows\System32\regsvr32.exe File deleted: C:\Windows\System32\GAjjZRZVj\QFdWkQKkPokX.dll:Zone.Identifier Jump to behavior
Creates files inside the system directory
Source: C:\Windows\System32\loaddll64.exe File created: C:\Windows\system32\ZcjkHmdxs\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A098 0_2_000000018001A098
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003E0D0 0_2_000000018003E0D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800180E0 0_2_00000001800180E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C0F4 0_2_000000018001C0F4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E134 0_2_000000018001E134
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C150 0_2_000000018002C150
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A1A0 0_2_000000018001A1A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004E1C0 0_2_000000018004E1C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800181E4 0_2_00000001800181E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026288 0_2_0000000180026288
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A2A8 0_2_000000018001A2A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800182E8 0_2_00000001800182E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E320 0_2_000000018001E320
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C324 0_2_000000018001C324
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180058338 0_2_0000000180058338
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A3B4 0_2_000000018001A3B4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800063E0 0_2_00000001800063E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800183F0 0_2_00000001800183F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002E420 0_2_000000018002E420
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E508 0_2_000000018001E508
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C510 0_2_000000018001C510
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180028514 0_2_0000000180028514
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C51C 0_2_000000018002C51C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018548 0_2_0000000180018548
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018005A5A4 0_2_000000018005A5A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026618 0_2_0000000180026618
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018650 0_2_0000000180018650
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180028668 0_2_0000000180028668
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004067C 0_2_000000018004067C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004E6F0 0_2_000000018004E6F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C6FC 0_2_000000018001C6FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E734 0_2_000000018001E734
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018758 0_2_0000000180018758
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800287E4 0_2_00000001800287E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018860 0_2_0000000180018860
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016870 0_2_0000000180016870
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800548F8 0_2_00000001800548F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C900 0_2_000000018002C900
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E91C 0_2_000000018001E91C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C92C 0_2_000000018001C92C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016978 0_2_0000000180016978
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800189CC 0_2_00000001800189CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026A24 0_2_0000000180026A24
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016A80 0_2_0000000180016A80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001EB04 0_2_000000018001EB04
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018B10 0_2_0000000180018B10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001CB18 0_2_000000018001CB18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016B8C 0_2_0000000180016B8C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004EBA0 0_2_000000018004EBA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018C54 0_2_0000000180018C54
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002CCCC 0_2_000000018002CCCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016CE8 0_2_0000000180016CE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001CD00 0_2_000000018001CD00
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001ED30 0_2_000000018001ED30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018D98 0_2_0000000180018D98
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016DF0 0_2_0000000180016DF0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004CEC8 0_2_000000018004CEC8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018EC8 0_2_0000000180018EC8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016EF8 0_2_0000000180016EF8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001EF18 0_2_000000018001EF18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001CF2C 0_2_000000018001CF2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180042F88 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018FD0 0_2_0000000180018FD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017000 0_2_0000000180017000
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800190D8 0_2_00000001800190D8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F104 0_2_000000018001F104
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D114 0_2_000000018001D114
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017158 0_2_0000000180017158
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002D19C 0_2_000000018002D19C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800191E0 0_2_00000001800191E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017260 0_2_0000000180017260
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D2FC 0_2_000000018001D2FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004F2FC 0_2_000000018004F2FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B310 0_2_000000018001B310
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F334 0_2_000000018001F334
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019338 0_2_0000000180019338
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017368 0_2_0000000180017368
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019440 0_2_0000000180019440
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017474 0_2_0000000180017474
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002B49C 0_2_000000018002B49C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B4F8 0_2_000000018001B4F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F520 0_2_000000018001F520
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D528 0_2_000000018001D528
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019548 0_2_0000000180019548
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800175D0 0_2_00000001800175D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019650 0_2_0000000180019650
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002D680 0_2_000000018002D680
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800176D4 0_2_00000001800176D4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F70C 0_2_000000018001F70C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D710 0_2_000000018001D710
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B724 0_2_000000018001B724
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004972C 0_2_000000018004972C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025740 0_2_0000000180025740
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800197B8 0_2_00000001800197B8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018004B7E8 0_2_000000018004B7E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017800 0_2_0000000180017800
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800198C0 0_2_00000001800198C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002B8D0 0_2_000000018002B8D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001D8FC 0_2_000000018001D8FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017908 0_2_0000000180017908
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B90C 0_2_000000018001B90C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F93C 0_2_000000018001F93C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800199C8 0_2_00000001800199C8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017A10 0_2_0000000180017A10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003FA6C 0_2_000000018003FA6C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180045A70 0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019AD0 0_2_0000000180019AD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025AD4 0_2_0000000180025AD4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BAF4 0_2_000000018001BAF4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017B18 0_2_0000000180017B18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001DB2C 0_2_000000018001DB2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002DB50 0_2_000000018002DB50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019C28 0_2_0000000180019C28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017C70 0_2_0000000180017C70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003BD00 0_2_000000018003BD00
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001DD18 0_2_000000018001DD18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002BD1C 0_2_000000018002BD1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BD20 0_2_000000018001BD20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019D30 0_2_0000000180019D30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017D78 0_2_0000000180017D78
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180045A70 0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019E38 0_2_0000000180019E38
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017E80 0_2_0000000180017E80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180049EEC 0_2_0000000180049EEC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025EFC 0_2_0000000180025EFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001DF04 0_2_000000018001DF04
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BF08 0_2_000000018001BF08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018003FF1C 0_2_000000018003FF1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019F40 0_2_0000000180019F40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017F88 0_2_0000000180017F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002DFAC 0_2_000000018002DFAC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015738050000 0_2_0000015738050000
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739987414 0_2_0000015739987414
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998A804 0_2_000001573998A804
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999B6BC 0_2_000001573999B6BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998FC70 0_2_000001573998FC70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739981B88 0_2_0000015739981B88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998EB08 0_2_000001573998EB08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739975B18 0_2_0000015739975B18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739988B3C 0_2_0000015739988B3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739997E28 0_2_0000015739997E28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998BD64 0_2_000001573998BD64
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997CCC8 0_2_000001573997CCC8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739971014 0_2_0000015739971014
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998B028 0_2_000001573998B028
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739994020 0_2_0000015739994020
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998406C 0_2_000001573998406C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739982F94 0_2_0000015739982F94
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998EFAC 0_2_000001573998EFAC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997DFCC 0_2_000001573997DFCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997EFCC 0_2_000001573997EFCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997AFE4 0_2_000001573997AFE4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739992F3C 0_2_0000015739992F3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739996F3C 0_2_0000015739996F3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739973F40 0_2_0000015739973F40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739978F5C 0_2_0000015739978F5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999BE90 0_2_000001573999BE90
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739989EC0 0_2_0000015739989EC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739994EF4 0_2_0000015739994EF4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739998EE8 0_2_0000015739998EE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739983210 0_2_0000015739983210
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997E254 0_2_000001573997E254
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998D254 0_2_000001573998D254
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998F238 0_2_000001573998F238
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399741A8 0_2_00000157399741A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997B1A8 0_2_000001573997B1A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739975198 0_2_0000015739975198
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399731F0 0_2_00000157399731F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739986110 0_2_0000015739986110
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997B0F8 0_2_000001573997B0F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998A130 0_2_000001573998A130
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739987144 0_2_0000015739987144
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999A088 0_2_000001573999A088
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739974078 0_2_0000015739974078
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399790D4 0_2_00000157399790D4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399730BC 0_2_00000157399730BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999B0EC 0_2_000001573999B0EC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998A408 0_2_000001573998A408
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399913FC 0_2_00000157399913FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739986418 0_2_0000015739986418
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999344C 0_2_000001573999344C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997C458 0_2_000001573997C458
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399793AC 0_2_00000157399793AC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399893E0 0_2_00000157399893E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997B3E4 0_2_000001573997B3E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999A304 0_2_000001573999A304
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739993304 0_2_0000015739993304
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399912FC 0_2_00000157399912FC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997D300 0_2_000001573997D300
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739994330 0_2_0000015739994330
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999632C 0_2_000001573999632C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739971368 0_2_0000015739971368
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739984368 0_2_0000015739984368
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997F290 0_2_000001573997F290
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997B2BC 0_2_000001573997B2BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399772E0 0_2_00000157399772E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739983610 0_2_0000015739983610
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998762C 0_2_000001573998762C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998D620 0_2_000001573998D620
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998F61C 0_2_000001573998F61C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739992638 0_2_0000015739992638
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739984594 0_2_0000015739984594
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739986594 0_2_0000015739986594
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997F580 0_2_000001573997F580
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739980578 0_2_0000015739980578
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998C5AC 0_2_000001573998C5AC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399725D8 0_2_00000157399725D8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739996520 0_2_0000015739996520
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999B570 0_2_000001573999B570
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998B558 0_2_000001573998B558
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999155C 0_2_000001573999155C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739975484 0_2_0000015739975484
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998E4A8 0_2_000001573998E4A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399814A0 0_2_00000157399814A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998D4D0 0_2_000001573998D4D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399824E4 0_2_00000157399824E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399984DC 0_2_00000157399984DC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739972820 0_2_0000015739972820
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997F850 0_2_000001573997F850
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739974848 0_2_0000015739974848
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998484C 0_2_000001573998484C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998E7A4 0_2_000001573998E7A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399827A4 0_2_00000157399827A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399907D0 0_2_00000157399907D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739972708 0_2_0000015739972708
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739989720 0_2_0000015739989720
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998C720 0_2_000001573998C720
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739983724 0_2_0000015739983724
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998F764 0_2_000001573998F764
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739980680 0_2_0000015739980680
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399846B4 0_2_00000157399846B4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399916A8 0_2_00000157399916A8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399976A4 0_2_00000157399976A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997B698 0_2_000001573997B698
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739976698 0_2_0000015739976698
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999369C 0_2_000001573999369C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399736E0 0_2_00000157399736E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739999A40 0_2_0000015739999A40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739998990 0_2_0000015739998990
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739986978 0_2_0000015739986978
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998D9C4 0_2_000001573998D9C4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399829BC 0_2_00000157399829BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998C9F0 0_2_000001573998C9F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399899F4 0_2_00000157399899F4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997D92C 0_2_000001573997D92C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739994918 0_2_0000015739994918
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739974948 0_2_0000015739974948
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999093C 0_2_000001573999093C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999796C 0_2_000001573999796C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739993894 0_2_0000015739993894
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998C8C0 0_2_000001573998C8C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000157399878C4 0_2_00000157399878C4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997BC08 0_2_000001573997BC08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739987C30 0_2_0000015739987C30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739985C50 0_2_0000015739985C50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739992C48 0_2_0000015739992C48
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739990C68 0_2_0000015739990C68
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739980C68 0_2_0000015739980C68
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739974C64 0_2_0000015739974C64
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739983BB4 0_2_0000015739983BB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739977BB4 0_2_0000015739977BB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998ABD8 0_2_000001573998ABD8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739992AFC 0_2_0000015739992AFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739998B28 0_2_0000015739998B28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739987B24 0_2_0000015739987B24
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739996B40 0_2_0000015739996B40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997CB6C 0_2_000001573997CB6C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997DB74 0_2_000001573997DB74
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739980B60 0_2_0000015739980B60
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739973A9C 0_2_0000015739973A9C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997FAD0 0_2_000001573997FAD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739990AC4 0_2_0000015739990AC4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739991AE0 0_2_0000015739991AE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739972AE4 0_2_0000015739972AE4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739992E04 0_2_0000015739992E04
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739995E30 0_2_0000015739995E30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739983E18 0_2_0000015739983E18
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997FE58 0_2_000001573997FE58
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998EE5C 0_2_000001573998EE5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997ED84 0_2_000001573997ED84
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739987DB0 0_2_0000015739987DB0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739999DA8 0_2_0000015739999DA8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739993DD4 0_2_0000015739993DD4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739990DBC 0_2_0000015739990DBC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739972DC0 0_2_0000015739972DC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739991D2C 0_2_0000015739991D2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573999BD20 0_2_000001573999BD20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573997BD24 0_2_000001573997BD24
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739983D1C 0_2_0000015739983D1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739989D5C 0_2_0000015739989D5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739977CAC 0_2_0000015739977CAC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739973CE8 0_2_0000015739973CE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998ACEC 0_2_000001573998ACEC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739978CE0 0_2_0000015739978CE0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A098 2_2_000000018001A098
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003E0D0 2_2_000000018003E0D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800180E0 2_2_00000001800180E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C0F4 2_2_000000018001C0F4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E134 2_2_000000018001E134
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002C150 2_2_000000018002C150
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A1A0 2_2_000000018001A1A0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004E1C0 2_2_000000018004E1C0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800181E4 2_2_00000001800181E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180026288 2_2_0000000180026288
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A2A8 2_2_000000018001A2A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800182E8 2_2_00000001800182E8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E320 2_2_000000018001E320
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C324 2_2_000000018001C324
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180058338 2_2_0000000180058338
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001A3B4 2_2_000000018001A3B4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800063E0 2_2_00000001800063E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800183F0 2_2_00000001800183F0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002E420 2_2_000000018002E420
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E508 2_2_000000018001E508
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C510 2_2_000000018001C510
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180028514 2_2_0000000180028514
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002C51C 2_2_000000018002C51C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018548 2_2_0000000180018548
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018005A5A4 2_2_000000018005A5A4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180026618 2_2_0000000180026618
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018650 2_2_0000000180018650
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180028668 2_2_0000000180028668
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004067C 2_2_000000018004067C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004E6F0 2_2_000000018004E6F0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C6FC 2_2_000000018001C6FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E734 2_2_000000018001E734
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018758 2_2_0000000180018758
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800287E4 2_2_00000001800287E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018860 2_2_0000000180018860
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016870 2_2_0000000180016870
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800548F8 2_2_00000001800548F8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002C900 2_2_000000018002C900
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001E91C 2_2_000000018001E91C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001C92C 2_2_000000018001C92C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016978 2_2_0000000180016978
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800189CC 2_2_00000001800189CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180026A24 2_2_0000000180026A24
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016A80 2_2_0000000180016A80
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001EB04 2_2_000000018001EB04
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018B10 2_2_0000000180018B10
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001CB18 2_2_000000018001CB18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016B8C 2_2_0000000180016B8C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004EBA0 2_2_000000018004EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018C54 2_2_0000000180018C54
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002CCCC 2_2_000000018002CCCC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016CE8 2_2_0000000180016CE8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001CD00 2_2_000000018001CD00
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001ED30 2_2_000000018001ED30
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018D98 2_2_0000000180018D98
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016DF0 2_2_0000000180016DF0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004CEC8 2_2_000000018004CEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018EC8 2_2_0000000180018EC8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180016EF8 2_2_0000000180016EF8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001EF18 2_2_000000018001EF18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001CF2C 2_2_000000018001CF2C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180042F88 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180018FD0 2_2_0000000180018FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017000 2_2_0000000180017000
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800190D8 2_2_00000001800190D8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F104 2_2_000000018001F104
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D114 2_2_000000018001D114
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017158 2_2_0000000180017158
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002D19C 2_2_000000018002D19C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800191E0 2_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017260 2_2_0000000180017260
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D2FC 2_2_000000018001D2FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004F2FC 2_2_000000018004F2FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B310 2_2_000000018001B310
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F334 2_2_000000018001F334
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019338 2_2_0000000180019338
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017368 2_2_0000000180017368
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019440 2_2_0000000180019440
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017474 2_2_0000000180017474
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002B49C 2_2_000000018002B49C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B4F8 2_2_000000018001B4F8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F520 2_2_000000018001F520
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D528 2_2_000000018001D528
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019548 2_2_0000000180019548
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800175D0 2_2_00000001800175D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019650 2_2_0000000180019650
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002D680 2_2_000000018002D680
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800176D4 2_2_00000001800176D4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F70C 2_2_000000018001F70C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D710 2_2_000000018001D710
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B724 2_2_000000018001B724
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004972C 2_2_000000018004972C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180025740 2_2_0000000180025740
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800197B8 2_2_00000001800197B8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018004B7E8 2_2_000000018004B7E8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017800 2_2_0000000180017800
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800198C0 2_2_00000001800198C0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002B8D0 2_2_000000018002B8D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001D8FC 2_2_000000018001D8FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017908 2_2_0000000180017908
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001B90C 2_2_000000018001B90C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001F93C 2_2_000000018001F93C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800199C8 2_2_00000001800199C8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017A10 2_2_0000000180017A10
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003FA6C 2_2_000000018003FA6C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180045A70 2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019AD0 2_2_0000000180019AD0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180025AD4 2_2_0000000180025AD4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001BAF4 2_2_000000018001BAF4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017B18 2_2_0000000180017B18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001DB2C 2_2_000000018001DB2C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002DB50 2_2_000000018002DB50
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019C28 2_2_0000000180019C28
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017C70 2_2_0000000180017C70
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003BD00 2_2_000000018003BD00
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001DD18 2_2_000000018001DD18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002BD1C 2_2_000000018002BD1C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001BD20 2_2_000000018001BD20
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019D30 2_2_0000000180019D30
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017D78 2_2_0000000180017D78
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180045A70 2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019E38 2_2_0000000180019E38
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017E80 2_2_0000000180017E80
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180049EEC 2_2_0000000180049EEC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180025EFC 2_2_0000000180025EFC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001DF04 2_2_000000018001DF04
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001BF08 2_2_000000018001BF08
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018003FF1C 2_2_000000018003FF1C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180019F40 2_2_0000000180019F40
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180017F88 2_2_0000000180017F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018002DFAC 2_2_000000018002DFAC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_006C0000 2_2_006C0000
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0208B6BC 2_2_0208B6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02077414 2_2_02077414
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207EB08 2_2_0207EB08
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02065B18 2_2_02065B18
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02078B3C 2_2_02078B3C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02071B88 2_2_02071B88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207A804 2_2_0207A804
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207C8C0 2_2_0207C8C0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02087E28 2_2_02087E28
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206CCC8 2_2_0206CCC8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207BD64 2_2_0207BD64
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02073210 2_2_02073210
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207F238 2_2_0207F238
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206E254 2_2_0206E254
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207D254 2_2_0207D254
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206F290 2_2_0206F290
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206B2BC 2_2_0206B2BC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020672E0 2_2_020672E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020812FC 2_2_020812FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206D300 2_2_0206D300
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0208A304 2_2_0208A304
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02083304 2_2_02083304
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0208632C 2_2_0208632C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02084330 2_2_02084330
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02061368 2_2_02061368
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02074368 2_2_02074368
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020693AC 2_2_020693AC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206B3E4 2_2_0206B3E4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020793E0 2_2_020793E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020813FC 2_2_020813FC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02061014 2_2_02061014
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02084020 2_2_02084020
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207B028 2_2_0207B028
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207406C 2_2_0207406C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02064078 2_2_02064078
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0208A088 2_2_0208A088
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020630BC 2_2_020630BC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020690D4 2_2_020690D4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0208B0EC 2_2_0208B0EC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206B0F8 2_2_0206B0F8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02076110 2_2_02076110
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207A130 2_2_0207A130
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02077144 2_2_02077144
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02065198 2_2_02065198
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020641A8 2_2_020641A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206B1A8 2_2_0206B1A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020631F0 2_2_020631F0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02073610 2_2_02073610
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207F61C 2_2_0207F61C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207D620 2_2_0207D620
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207762C 2_2_0207762C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02082638 2_2_02082638
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02070680 2_2_02070680
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0208369C 2_2_0208369C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0206B698 2_2_0206B698
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02066698 2_2_02066698
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020816A8 2_2_020816A8
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020876A4 2_2_020876A4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020746B4 2_2_020746B4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020636E0 2_2_020636E0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02062708 2_2_02062708
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02073724 2_2_02073724
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02079720 2_2_02079720
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207C720 2_2_0207C720
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207F764 2_2_0207F764
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207E7A4 2_2_0207E7A4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020727A4 2_2_020727A4
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_020807D0 2_2_020807D0
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0207A408 2_2_0207A408
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02076418 2_2_02076418
Found potential string decryption / allocating functions
Source: C:\Windows\System32\loaddll64.exe Code function: String function: 0000000180046D38 appears 44 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 0000000180046D38 appears 44 times
Tries to load missing DLLs
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xboxlivetitleid.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cdpsgshims.dll Jump to behavior
Source: MIpuuSiSZ4.dll Virustotal: Detection: 72%
Source: MIpuuSiSZ4.dll Metadefender: Detection: 54%
Source: MIpuuSiSZ4.dll ReversingLabs: Detection: 88%
Source: MIpuuSiSZ4.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll"
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6776 -s 324
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6792 -s 328
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll"
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Windows\System32\loaddll64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER31C2.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winDLL@33/16@0/28
Source: C:\Windows\System32\loaddll64.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000001573998A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,FindCloseChangeNotification, 0_2_000001573998A804
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6792
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:6352:120:WilError_01
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6776
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800011AC LoadStringW,LoadStringW,FindResourceA,LoadResource,LockResource, 0_2_00000001800011AC
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: MIpuuSiSZ4.dll Static PE information: Image base 0x180000000 > 0x60000000
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: MIpuuSiSZ4.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MIpuuSiSZ4.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000015739978C72 push ebp; ret 0_2_0000015739978C7D
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_02068C72 push ebp; ret 2_2_02068C7D
PE file contains sections with non-standard names
Source: MIpuuSiSZ4.dll Static PE information: section name: _RDATA
Registers a DLL
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe PE file moved: C:\Windows\System32\GAjjZRZVj\QFdWkQKkPokX.dll Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\loaddll64.exe File opened: C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 7016 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7020 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1032 Thread sleep time: -30000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality to enumerate running services
Source: C:\Windows\System32\regsvr32.exe Code function: EnumServicesStatusExW, 2_2_0207DD40
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\loaddll64.exe API coverage: 9.0 %
Source: C:\Windows\System32\regsvr32.exe API coverage: 7.1 %
Source: C:\Windows\System32\loaddll64.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180042F88 FindFirstFileExW, 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180042F88 FindFirstFileExW, 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02D2C9F0 FindFirstFileW,FindNextFileW, 12_2_02D2C9F0
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "@Hyper-V RAWGlobal\BFE_Notify_Event_{f3c219e5-8073-4743-9b26-35724d75b7c3}LMEM
Source: svchost.exe, 00000020.00000002.649906463.00000298A2700000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000007.00000002.661391909.0000017603802000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000009.00000002.626869690.000002413A259000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.625682040.0000024134C29000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649489638.00000298A1E70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000002.00000003.338636942.0000000000814000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000007.00000002.661773254.0000017603840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.661749128.000001E262629000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000000018001360C
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180048198 GetProcessHeap, 0_2_0000000180048198
Checks if the current process is being debugged
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0000000180002F14
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000000018001360C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000000018000386C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003A54 SetUnhandledExceptionFilter, 0_2_0000000180003A54
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_0000000180002F14
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_000000018001360C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_000000018000386C
Source: C:\Windows\System32\regsvr32.exe Code function: 2_2_0000000180003A54 SetUnhandledExceptionFilter, 2_2_0000000180003A54

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 174.138.33.49 7080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_000000018004C150
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_000000018004C1D4
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_000000018004C2A4
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_000000018004C364
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_000000018004C5B0
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_0000000180046664
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_000000018004C708
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_0000000180046788
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_000000018004C7DC
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW, 0_2_0000000180046810
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_000000018004C908
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_00000001800475F0
Source: C:\Windows\System32\loaddll64.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_000000018004BE04
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_000000018004C150
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_000000018004C1D4
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_000000018004C2A4
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 2_2_000000018004C364
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 2_2_000000018004C5B0
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_0000000180046664
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 2_2_000000018004C708
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_0000000180046788
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 2_2_000000018004C7DC
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW, 2_2_0000000180046810
Source: C:\Windows\System32\regsvr32.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 2_2_000000018004C908
Source: C:\Windows\System32\regsvr32.exe Code function: GetLocaleInfoW, 2_2_00000001800475F0
Source: C:\Windows\System32\regsvr32.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 2_2_000000018004BE04
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180059100 cpuid 0_2_0000000180059100
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800032C0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00000001800032C0

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 00000014.00000002.662009877.000001B1E9902000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000014.00000002.661820829.000001B1E983D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: $@V%ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information
barindex
Source: Yara match File source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Emotet
Source: Yara match File source: 2.2.regsvr32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.20000010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.1a029ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.1a029ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.20000010000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.regsvr32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.rundll32.exe.14980010000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.15738060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.15738060000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 671702 Sample: MIpuuSiSZ4.dll Startdate: 22/07/2022 Architecture: WINDOWS Score: 100 42 200.18.0.0 UniversidadeFederaldeSantaCatarinaBR Brazil 2->42 44 100.7.0.0 UUNETUS United States 2->44 46 23 other IPs or domains 2->46 54 Snort IDS alert for network traffic 2->54 56 Antivirus detection for URL or domain 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 3 other signatures 2->60 9 loaddll64.exe 3 2->9         started        12 svchost.exe 2->12         started        14 svchost.exe 9 1 2->14         started        17 9 other processes 2->17 signatures3 process4 dnsIp5 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->64 19 regsvr32.exe 5 9->19         started        22 cmd.exe 1 9->22         started        24 rundll32.exe 9->24         started        28 3 other processes 9->28 66 Changes security center settings (notifications, updates, antivirus, firewall) 12->66 26 MpCmdRun.exe 12->26         started        48 127.0.0.1 unknown unknown 14->48 50 192.168.2.1 unknown unknown 17->50 signatures6 process7 signatures8 62 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->62 30 regsvr32.exe 19->30         started        34 rundll32.exe 22->34         started        36 WerFault.exe 9 24->36         started        38 conhost.exe 26->38         started        process9 dnsIp10 52 174.138.33.49, 49761, 7080 DIGITALOCEAN-ASNUS United States 30->52 68 System process connects to network (likely due to code injection or exploit) 30->68 40 WerFault.exe 20 9 34->40         started        signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
174.138.33.49
 unknown United States
14061 DIGITALOCEAN-ASNUS true
248.6.0.0
 unknown Reserved
unknown unknown true
20.7.0.0
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS true
101.69.85.108
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN true
176.6.0.0
 unknown Germany
12638 AS12638DuesseldorfDE true
144.1.49.1
 unknown unknown
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN true
80.7.0.0
 unknown United Kingdom
5089 NTLGB true
64.7.0.0
 unknown United States
4565 MEGAPATH2-US true
24.7.0.0
 unknown United States
7922 COMCAST-7922US true
112.7.0.0
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany true
4.7.0.0
 unknown United States
3356 LEVEL3US true
208.9.0.0
 unknown United States
1239 SPRINTLINKUS true
232.6.0.0
 unknown Reserved
unknown unknown true
96.7.0.0
 unknown United States
262589 INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR true
204.6.0.0
 unknown United States
174 COGENT-174US true
172.6.0.0
 unknown United States
7018 ATT-INTERNET4US true
100.7.0.0
 unknown United States
701 UUNETUS true
180.6.0.0
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP true
84.7.0.0
 unknown France
8228 CEGETEL-ASFR true
200.18.0.0
 unknown Brazil
10715 UniversidadeFederaldeSantaCatarinaBR true
136.6.0.0
 unknown United States
60311 ONEFMCH true
236.6.0.0
 unknown Reserved
unknown unknown true
68.7.0.0
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS true
116.7.0.0
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr true
8.7.0.0
 unknown United States
3356 LEVEL3US true
82.10.0.0
 unknown United Kingdom
5089 NTLGB true

Private

IP
192.168.2.1
127.0.0.1