Edit tour

Windows Analysis Report
MIpuuSiSZ4.dll

Overview

General Information

Sample Name:	MIpuuSiSZ4.dll
Analysis ID:	671702
MD5:	1dd34935a785a419fb552b5086ea682e
SHA1:	c6c966e4ba623f9972273de07b842ffbb9a9efce
SHA256:	8b5a10f9a8f2b25057442111a01faf021ef7e048eab875a4078a44758d952c6f
Tags:	exeOpenCTIBRSandboxed
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Changes security center settings (notifications, updates, antivirus, firewall)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to enumerate running services

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Registers a DLL

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6740 cmdline: loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 6756 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 6776 cmdline: rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 1992 cmdline: C:\Windows\system32\WerFault.exe -u -p 6776 -s 324 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

regsvr32.exe (PID: 6764 cmdline: regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 5660 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 6792 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 3660 cmdline: C:\Windows\system32\WerFault.exe -u -p 6792 -s 328 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

rundll32.exe (PID: 6836 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6852 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 5852 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

svchost.exe (PID: 6880 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6984 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 908 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6380 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1524 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 5112 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 1428 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6256 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 7100 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5604 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["101.69.85.108:20", "200.18.0.0:1", "208.9.0.0:2512", "82.10.0.0:2642", "144.1.49.1:2", "20.7.0.0:1", "176.6.0.0:1", "232.6.0.0:1", "136.6.0.0:1", "24.7.0.0:1", "248.6.0.0:1", "68.7.0.0:1", "80.7.0.0:1", "172.6.0.0:1", "96.7.0.0:1", "84.7.0.0:1", "4.7.0.0:1", "100.7.0.0:1", "112.7.0.0:1", "116.7.0.0:1", "180.6.0.0:1", "8.7.0.0:1", "236.6.0.0:1", "64.7.0.0:1", "204.6.0.0:1"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3		Joe Security
00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.regsvr32.exe.710000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.regsvr32.exe.2cb0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.20000010000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.22fc4510000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.14980010000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.1a029ee0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.1a029ee0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.22fc4510000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.20000010000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.710000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.14980010000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.regsvr32.exe.2cb0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll64.exe.15738060000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll64.exe.15738060000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 17 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 9 - Source IP: 192.168.2.7 - Destination IP: 174.138.33.49

Timestamp:	192.168.2.7174.138.33.494979470802404316 07/22/22-13:58:44.263207
SID:	2404316
Source Port:	49794
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: MIpuuSiSZ4.dll	Virustotal: Detection: 72%	Perma Link
Source: MIpuuSiSZ4.dll	Metadefender: Detection: 54%	Perma Link
Source: MIpuuSiSZ4.dll	ReversingLabs: Detection: 88%

Antivirus detection for URL or domain

Source: https://174.138.33.49:7080/x	Avira URL Cloud: Label: malware
Source: https://174.138.33.49/T	Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/tem	URL Reputation: Label: malware
Source: https://174.138.33.49:7080/944	Avira URL Cloud: Label: malware

Source: 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["101.69.85.108:20", "200.18.0.0:1", "208.9.0.0:2512", "82.10.0.0:2642", "144.1.49.1:2", "20.7.0.0:1", "176.6.0.0:1", "232.6.0.0:1", "136.6.0.0:1", "24.7.0.0:1", "248.6.0.0:1", "68.7.0.0:1", "80.7.0.0:1", "172.6.0.0:1", "96.7.0.0:1", "84.7.0.0:1", "4.7.0.0:1", "100.7.0.0:1", "112.7.0.0:1", "116.7.0.0:1", "180.6.0.0:1", "8.7.0.0:1", "236.6.0.0:1", "64.7.0.0:1", "204.6.0.0:1"]}

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042F88 FindFirstFileExW,	0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180042F88 FindFirstFileExW,	2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02D2C9F0 FindFirstFileW,FindNextFileW,	12_2_02D2C9F0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 174.138.33.49 7080

Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.7:49794 -> 174.138.33.49:7080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 101.69.85.108:20
Source: Malware configuration extractor	IPs: 200.18.0.0:1
Source: Malware configuration extractor	IPs: 208.9.0.0:2512
Source: Malware configuration extractor	IPs: 82.10.0.0:2642
Source: Malware configuration extractor	IPs: 144.1.49.1:2
Source: Malware configuration extractor	IPs: 20.7.0.0:1
Source: Malware configuration extractor	IPs: 176.6.0.0:1
Source: Malware configuration extractor	IPs: 232.6.0.0:1
Source: Malware configuration extractor	IPs: 136.6.0.0:1
Source: Malware configuration extractor	IPs: 24.7.0.0:1
Source: Malware configuration extractor	IPs: 248.6.0.0:1
Source: Malware configuration extractor	IPs: 68.7.0.0:1
Source: Malware configuration extractor	IPs: 80.7.0.0:1
Source: Malware configuration extractor	IPs: 172.6.0.0:1
Source: Malware configuration extractor	IPs: 96.7.0.0:1
Source: Malware configuration extractor	IPs: 84.7.0.0:1
Source: Malware configuration extractor	IPs: 4.7.0.0:1
Source: Malware configuration extractor	IPs: 100.7.0.0:1
Source: Malware configuration extractor	IPs: 112.7.0.0:1
Source: Malware configuration extractor	IPs: 116.7.0.0:1
Source: Malware configuration extractor	IPs: 180.6.0.0:1
Source: Malware configuration extractor	IPs: 8.7.0.0:1
Source: Malware configuration extractor	IPs: 236.6.0.0:1
Source: Malware configuration extractor	IPs: 64.7.0.0:1
Source: Malware configuration extractor	IPs: 204.6.0.0:1

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Joe Sandbox View

IP Address: 174.138.33.49 174.138.33.49

Source: global traffic

TCP traffic: 192.168.2.3:49761 -> 174.138.33.49:7080

Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49

Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.605830890.00000298A2784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z\|\|.\|\|b7e2ac48-308b-4ab0-ad70-c01dd95863e0\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.605830890.00000298A2784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z\|\|.\|\|b7e2ac48-308b-4ab0-ad70-c01dd95863e0\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649942559.00000298A2711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.662502712.000000000136D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445329795.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000C.00000003.443936950.000000000138D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445018013.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.663236738.000000000350D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445267551.000000000350D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445153458.00000000034E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e0707f5d6733f
Source: regsvr32.exe, 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabvH
Source: regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/pXX
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.come
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/T
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/944
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/tem
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/x
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000012.00000002.405466984.000002D97084E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405005326.000002D970845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405447191.000002D97083A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000020.00000003.629383351.00000298A279F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

E-Banking Fraud

Source: Yara match

File source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Emotet

Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6776 -s 324

Source: C:\Windows\System32\regsvr32.exe

File deleted: C:\Windows\System32\GAjjZRZVj\QFdWkQKkPokX.dll:Zone.Identifier

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

File created: C:\Windows\system32\ZcjkHmdxs\

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A098	0_2_000000018001A098
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003E0D0	0_2_000000018003E0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800180E0	0_2_00000001800180E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C0F4	0_2_000000018001C0F4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E134	0_2_000000018001E134
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002C150	0_2_000000018002C150
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A1A0	0_2_000000018001A1A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004E1C0	0_2_000000018004E1C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800181E4	0_2_00000001800181E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026288	0_2_0000000180026288
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A2A8	0_2_000000018001A2A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800182E8	0_2_00000001800182E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E320	0_2_000000018001E320
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C324	0_2_000000018001C324
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180058338	0_2_0000000180058338
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A3B4	0_2_000000018001A3B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800063E0	0_2_00000001800063E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800183F0	0_2_00000001800183F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002E420	0_2_000000018002E420
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E508	0_2_000000018001E508
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C510	0_2_000000018001C510
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028514	0_2_0000000180028514
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002C51C	0_2_000000018002C51C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018548	0_2_0000000180018548
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018005A5A4	0_2_000000018005A5A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026618	0_2_0000000180026618
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018650	0_2_0000000180018650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028668	0_2_0000000180028668
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004067C	0_2_000000018004067C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004E6F0	0_2_000000018004E6F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C6FC	0_2_000000018001C6FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E734	0_2_000000018001E734
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018758	0_2_0000000180018758
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC	0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800287E4	0_2_00000001800287E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018860	0_2_0000000180018860
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016870	0_2_0000000180016870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800548F8	0_2_00000001800548F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002C900	0_2_000000018002C900
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E91C	0_2_000000018001E91C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C92C	0_2_000000018001C92C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016978	0_2_0000000180016978
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800189CC	0_2_00000001800189CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC	0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026A24	0_2_0000000180026A24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016A80	0_2_0000000180016A80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001EB04	0_2_000000018001EB04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018B10	0_2_0000000180018B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CB18	0_2_000000018001CB18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016B8C	0_2_0000000180016B8C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004EBA0	0_2_000000018004EBA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018C54	0_2_0000000180018C54
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002CCCC	0_2_000000018002CCCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016CE8	0_2_0000000180016CE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CD00	0_2_000000018001CD00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001ED30	0_2_000000018001ED30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018D98	0_2_0000000180018D98
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016DF0	0_2_0000000180016DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004CEC8	0_2_000000018004CEC8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018EC8	0_2_0000000180018EC8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016EF8	0_2_0000000180016EF8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001EF18	0_2_000000018001EF18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CF2C	0_2_000000018001CF2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042F88	0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018FD0	0_2_0000000180018FD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017000	0_2_0000000180017000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800190D8	0_2_00000001800190D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F104	0_2_000000018001F104
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D114	0_2_000000018001D114
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017158	0_2_0000000180017158
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002D19C	0_2_000000018002D19C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800191E0	0_2_00000001800191E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017260	0_2_0000000180017260
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D2FC	0_2_000000018001D2FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004F2FC	0_2_000000018004F2FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B310	0_2_000000018001B310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F334	0_2_000000018001F334
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019338	0_2_0000000180019338
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017368	0_2_0000000180017368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019440	0_2_0000000180019440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017474	0_2_0000000180017474
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002B49C	0_2_000000018002B49C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B4F8	0_2_000000018001B4F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F520	0_2_000000018001F520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D528	0_2_000000018001D528
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019548	0_2_0000000180019548
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800175D0	0_2_00000001800175D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019650	0_2_0000000180019650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002D680	0_2_000000018002D680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800176D4	0_2_00000001800176D4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F70C	0_2_000000018001F70C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D710	0_2_000000018001D710
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B724	0_2_000000018001B724
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004972C	0_2_000000018004972C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025740	0_2_0000000180025740
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800197B8	0_2_00000001800197B8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004B7E8	0_2_000000018004B7E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017800	0_2_0000000180017800
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800198C0	0_2_00000001800198C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002B8D0	0_2_000000018002B8D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D8FC	0_2_000000018001D8FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017908	0_2_0000000180017908
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B90C	0_2_000000018001B90C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F93C	0_2_000000018001F93C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800199C8	0_2_00000001800199C8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017A10	0_2_0000000180017A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003FA6C	0_2_000000018003FA6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180045A70	0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019AD0	0_2_0000000180019AD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025AD4	0_2_0000000180025AD4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001BAF4	0_2_000000018001BAF4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017B18	0_2_0000000180017B18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001DB2C	0_2_000000018001DB2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002DB50	0_2_000000018002DB50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019C28	0_2_0000000180019C28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017C70	0_2_0000000180017C70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003BD00	0_2_000000018003BD00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001DD18	0_2_000000018001DD18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002BD1C	0_2_000000018002BD1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001BD20	0_2_000000018001BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019D30	0_2_0000000180019D30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017D78	0_2_0000000180017D78
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180045A70	0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019E38	0_2_0000000180019E38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017E80	0_2_0000000180017E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180049EEC	0_2_0000000180049EEC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025EFC	0_2_0000000180025EFC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001DF04	0_2_000000018001DF04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001BF08	0_2_000000018001BF08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003FF1C	0_2_000000018003FF1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019F40	0_2_0000000180019F40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017F88	0_2_0000000180017F88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002DFAC	0_2_000000018002DFAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015738050000	0_2_0000015738050000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987414	0_2_0000015739987414
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998A804	0_2_000001573998A804
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999B6BC	0_2_000001573999B6BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998FC70	0_2_000001573998FC70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739981B88	0_2_0000015739981B88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998EB08	0_2_000001573998EB08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739975B18	0_2_0000015739975B18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739988B3C	0_2_0000015739988B3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739997E28	0_2_0000015739997E28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998BD64	0_2_000001573998BD64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997CCC8	0_2_000001573997CCC8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739971014	0_2_0000015739971014
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998B028	0_2_000001573998B028
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994020	0_2_0000015739994020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998406C	0_2_000001573998406C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739982F94	0_2_0000015739982F94
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998EFAC	0_2_000001573998EFAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997DFCC	0_2_000001573997DFCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997EFCC	0_2_000001573997EFCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997AFE4	0_2_000001573997AFE4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992F3C	0_2_0000015739992F3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739996F3C	0_2_0000015739996F3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739973F40	0_2_0000015739973F40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739978F5C	0_2_0000015739978F5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999BE90	0_2_000001573999BE90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739989EC0	0_2_0000015739989EC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994EF4	0_2_0000015739994EF4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739998EE8	0_2_0000015739998EE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983210	0_2_0000015739983210
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997E254	0_2_000001573997E254
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D254	0_2_000001573998D254
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998F238	0_2_000001573998F238
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399741A8	0_2_00000157399741A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B1A8	0_2_000001573997B1A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739975198	0_2_0000015739975198
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399731F0	0_2_00000157399731F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986110	0_2_0000015739986110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B0F8	0_2_000001573997B0F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998A130	0_2_000001573998A130
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987144	0_2_0000015739987144
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999A088	0_2_000001573999A088
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974078	0_2_0000015739974078
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399790D4	0_2_00000157399790D4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399730BC	0_2_00000157399730BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999B0EC	0_2_000001573999B0EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998A408	0_2_000001573998A408
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399913FC	0_2_00000157399913FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986418	0_2_0000015739986418
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999344C	0_2_000001573999344C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997C458	0_2_000001573997C458
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399793AC	0_2_00000157399793AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399893E0	0_2_00000157399893E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B3E4	0_2_000001573997B3E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999A304	0_2_000001573999A304
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739993304	0_2_0000015739993304
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399912FC	0_2_00000157399912FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997D300	0_2_000001573997D300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994330	0_2_0000015739994330
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999632C	0_2_000001573999632C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739971368	0_2_0000015739971368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739984368	0_2_0000015739984368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997F290	0_2_000001573997F290
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B2BC	0_2_000001573997B2BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399772E0	0_2_00000157399772E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983610	0_2_0000015739983610
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998762C	0_2_000001573998762C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D620	0_2_000001573998D620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998F61C	0_2_000001573998F61C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992638	0_2_0000015739992638
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739984594	0_2_0000015739984594
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986594	0_2_0000015739986594
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997F580	0_2_000001573997F580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980578	0_2_0000015739980578
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C5AC	0_2_000001573998C5AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399725D8	0_2_00000157399725D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739996520	0_2_0000015739996520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999B570	0_2_000001573999B570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998B558	0_2_000001573998B558
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999155C	0_2_000001573999155C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739975484	0_2_0000015739975484
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998E4A8	0_2_000001573998E4A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399814A0	0_2_00000157399814A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D4D0	0_2_000001573998D4D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399824E4	0_2_00000157399824E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399984DC	0_2_00000157399984DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972820	0_2_0000015739972820
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997F850	0_2_000001573997F850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974848	0_2_0000015739974848
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998484C	0_2_000001573998484C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998E7A4	0_2_000001573998E7A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399827A4	0_2_00000157399827A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399907D0	0_2_00000157399907D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972708	0_2_0000015739972708
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739989720	0_2_0000015739989720
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C720	0_2_000001573998C720
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983724	0_2_0000015739983724
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998F764	0_2_000001573998F764
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980680	0_2_0000015739980680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399846B4	0_2_00000157399846B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399916A8	0_2_00000157399916A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399976A4	0_2_00000157399976A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B698	0_2_000001573997B698
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739976698	0_2_0000015739976698
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999369C	0_2_000001573999369C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399736E0	0_2_00000157399736E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739999A40	0_2_0000015739999A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739998990	0_2_0000015739998990
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986978	0_2_0000015739986978
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D9C4	0_2_000001573998D9C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399829BC	0_2_00000157399829BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C9F0	0_2_000001573998C9F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399899F4	0_2_00000157399899F4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997D92C	0_2_000001573997D92C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994918	0_2_0000015739994918
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974948	0_2_0000015739974948
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999093C	0_2_000001573999093C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999796C	0_2_000001573999796C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739993894	0_2_0000015739993894
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C8C0	0_2_000001573998C8C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399878C4	0_2_00000157399878C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997BC08	0_2_000001573997BC08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987C30	0_2_0000015739987C30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739985C50	0_2_0000015739985C50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992C48	0_2_0000015739992C48
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739990C68	0_2_0000015739990C68
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980C68	0_2_0000015739980C68
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974C64	0_2_0000015739974C64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983BB4	0_2_0000015739983BB4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739977BB4	0_2_0000015739977BB4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998ABD8	0_2_000001573998ABD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992AFC	0_2_0000015739992AFC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739998B28	0_2_0000015739998B28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987B24	0_2_0000015739987B24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739996B40	0_2_0000015739996B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997CB6C	0_2_000001573997CB6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997DB74	0_2_000001573997DB74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980B60	0_2_0000015739980B60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739973A9C	0_2_0000015739973A9C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997FAD0	0_2_000001573997FAD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739990AC4	0_2_0000015739990AC4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739991AE0	0_2_0000015739991AE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972AE4	0_2_0000015739972AE4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992E04	0_2_0000015739992E04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739995E30	0_2_0000015739995E30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983E18	0_2_0000015739983E18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997FE58	0_2_000001573997FE58
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998EE5C	0_2_000001573998EE5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997ED84	0_2_000001573997ED84
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987DB0	0_2_0000015739987DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739999DA8	0_2_0000015739999DA8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739993DD4	0_2_0000015739993DD4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739990DBC	0_2_0000015739990DBC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972DC0	0_2_0000015739972DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739991D2C	0_2_0000015739991D2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999BD20	0_2_000001573999BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997BD24	0_2_000001573997BD24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983D1C	0_2_0000015739983D1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739989D5C	0_2_0000015739989D5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739977CAC	0_2_0000015739977CAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739973CE8	0_2_0000015739973CE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998ACEC	0_2_000001573998ACEC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739978CE0	0_2_0000015739978CE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A098	2_2_000000018001A098
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003E0D0	2_2_000000018003E0D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800180E0	2_2_00000001800180E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C0F4	2_2_000000018001C0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E134	2_2_000000018001E134
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002C150	2_2_000000018002C150
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A1A0	2_2_000000018001A1A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004E1C0	2_2_000000018004E1C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800181E4	2_2_00000001800181E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180026288	2_2_0000000180026288
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A2A8	2_2_000000018001A2A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800182E8	2_2_00000001800182E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E320	2_2_000000018001E320
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C324	2_2_000000018001C324
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180058338	2_2_0000000180058338
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A3B4	2_2_000000018001A3B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800063E0	2_2_00000001800063E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800183F0	2_2_00000001800183F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002E420	2_2_000000018002E420
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E508	2_2_000000018001E508
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C510	2_2_000000018001C510
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180028514	2_2_0000000180028514
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002C51C	2_2_000000018002C51C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018548	2_2_0000000180018548
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018005A5A4	2_2_000000018005A5A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180026618	2_2_0000000180026618
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018650	2_2_0000000180018650
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180028668	2_2_0000000180028668
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004067C	2_2_000000018004067C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004E6F0	2_2_000000018004E6F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C6FC	2_2_000000018001C6FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E734	2_2_000000018001E734
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018758	2_2_0000000180018758
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC	2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800287E4	2_2_00000001800287E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018860	2_2_0000000180018860
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016870	2_2_0000000180016870
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800548F8	2_2_00000001800548F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002C900	2_2_000000018002C900
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E91C	2_2_000000018001E91C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C92C	2_2_000000018001C92C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016978	2_2_0000000180016978
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800189CC	2_2_00000001800189CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC	2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180026A24	2_2_0000000180026A24
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016A80	2_2_0000000180016A80
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EB04	2_2_000000018001EB04
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018B10	2_2_0000000180018B10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CB18	2_2_000000018001CB18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016B8C	2_2_0000000180016B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004EBA0	2_2_000000018004EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018C54	2_2_0000000180018C54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002CCCC	2_2_000000018002CCCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016CE8	2_2_0000000180016CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CD00	2_2_000000018001CD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001ED30	2_2_000000018001ED30
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018D98	2_2_0000000180018D98
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016DF0	2_2_0000000180016DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004CEC8	2_2_000000018004CEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018EC8	2_2_0000000180018EC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016EF8	2_2_0000000180016EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EF18	2_2_000000018001EF18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CF2C	2_2_000000018001CF2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180042F88	2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018FD0	2_2_0000000180018FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017000	2_2_0000000180017000
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800190D8	2_2_00000001800190D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F104	2_2_000000018001F104
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D114	2_2_000000018001D114
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017158	2_2_0000000180017158
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002D19C	2_2_000000018002D19C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800191E0	2_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017260	2_2_0000000180017260
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D2FC	2_2_000000018001D2FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004F2FC	2_2_000000018004F2FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B310	2_2_000000018001B310
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F334	2_2_000000018001F334
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019338	2_2_0000000180019338
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017368	2_2_0000000180017368
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019440	2_2_0000000180019440
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017474	2_2_0000000180017474
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002B49C	2_2_000000018002B49C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B4F8	2_2_000000018001B4F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F520	2_2_000000018001F520
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D528	2_2_000000018001D528
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019548	2_2_0000000180019548
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800175D0	2_2_00000001800175D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019650	2_2_0000000180019650
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002D680	2_2_000000018002D680
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800176D4	2_2_00000001800176D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F70C	2_2_000000018001F70C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D710	2_2_000000018001D710
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B724	2_2_000000018001B724
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004972C	2_2_000000018004972C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025740	2_2_0000000180025740
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800197B8	2_2_00000001800197B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004B7E8	2_2_000000018004B7E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017800	2_2_0000000180017800
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800198C0	2_2_00000001800198C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002B8D0	2_2_000000018002B8D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D8FC	2_2_000000018001D8FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017908	2_2_0000000180017908
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B90C	2_2_000000018001B90C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F93C	2_2_000000018001F93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800199C8	2_2_00000001800199C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017A10	2_2_0000000180017A10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003FA6C	2_2_000000018003FA6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180045A70	2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019AD0	2_2_0000000180019AD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025AD4	2_2_0000000180025AD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BAF4	2_2_000000018001BAF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017B18	2_2_0000000180017B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DB2C	2_2_000000018001DB2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002DB50	2_2_000000018002DB50
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019C28	2_2_0000000180019C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017C70	2_2_0000000180017C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003BD00	2_2_000000018003BD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DD18	2_2_000000018001DD18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002BD1C	2_2_000000018002BD1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BD20	2_2_000000018001BD20
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019D30	2_2_0000000180019D30
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017D78	2_2_0000000180017D78
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180045A70	2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019E38	2_2_0000000180019E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017E80	2_2_0000000180017E80
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180049EEC	2_2_0000000180049EEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025EFC	2_2_0000000180025EFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DF04	2_2_000000018001DF04
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BF08	2_2_000000018001BF08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003FF1C	2_2_000000018003FF1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019F40	2_2_0000000180019F40
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017F88	2_2_0000000180017F88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002DFAC	2_2_000000018002DFAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_006C0000	2_2_006C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208B6BC	2_2_0208B6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02077414	2_2_02077414
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207EB08	2_2_0207EB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02065B18	2_2_02065B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02078B3C	2_2_02078B3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02071B88	2_2_02071B88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207A804	2_2_0207A804
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207C8C0	2_2_0207C8C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02087E28	2_2_02087E28
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206CCC8	2_2_0206CCC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207BD64	2_2_0207BD64
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02073210	2_2_02073210
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207F238	2_2_0207F238
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206E254	2_2_0206E254
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207D254	2_2_0207D254
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206F290	2_2_0206F290
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B2BC	2_2_0206B2BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020672E0	2_2_020672E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020812FC	2_2_020812FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206D300	2_2_0206D300
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208A304	2_2_0208A304
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02083304	2_2_02083304
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208632C	2_2_0208632C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02084330	2_2_02084330
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02061368	2_2_02061368
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02074368	2_2_02074368
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020693AC	2_2_020693AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B3E4	2_2_0206B3E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020793E0	2_2_020793E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020813FC	2_2_020813FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02061014	2_2_02061014
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02084020	2_2_02084020
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207B028	2_2_0207B028
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207406C	2_2_0207406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02064078	2_2_02064078
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208A088	2_2_0208A088
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020630BC	2_2_020630BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020690D4	2_2_020690D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208B0EC	2_2_0208B0EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B0F8	2_2_0206B0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02076110	2_2_02076110
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207A130	2_2_0207A130
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02077144	2_2_02077144
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02065198	2_2_02065198
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020641A8	2_2_020641A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B1A8	2_2_0206B1A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020631F0	2_2_020631F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02073610	2_2_02073610
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207F61C	2_2_0207F61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207D620	2_2_0207D620
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207762C	2_2_0207762C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02082638	2_2_02082638
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02070680	2_2_02070680
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208369C	2_2_0208369C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B698	2_2_0206B698
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02066698	2_2_02066698
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020816A8	2_2_020816A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020876A4	2_2_020876A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020746B4	2_2_020746B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020636E0	2_2_020636E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02062708	2_2_02062708
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02073724	2_2_02073724
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02079720	2_2_02079720
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207C720	2_2_0207C720
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207F764	2_2_0207F764
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207E7A4	2_2_0207E7A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020727A4	2_2_020727A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020807D0	2_2_020807D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207A408	2_2_0207A408
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02076418	2_2_02076418

Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 0000000180046D38 appears 44 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 0000000180046D38 appears 44 times

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior

Source: MIpuuSiSZ4.dll	Virustotal: Detection: 72%
Source: MIpuuSiSZ4.dll	Metadefender: Detection: 54%
Source: MIpuuSiSZ4.dll	ReversingLabs: Detection: 88%

Source: MIpuuSiSZ4.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6776 -s 324
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6792 -s 328
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER31C2.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@33/16@0/28

Source: C:\Windows\System32\loaddll64.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001573998A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,FindCloseChangeNotification,

0_2_000001573998A804

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6792
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6352:120:WilError_01
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6776

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00000001800011AC LoadStringW,LoadStringW,FindResourceA,LoadResource,LockResource,

0_2_00000001800011AC

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: MIpuuSiSZ4.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MIpuuSiSZ4.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739978C72 push ebp; ret		0_2_0000015739978C7D
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02068C72 push ebp; ret		2_2_02068C7D

Source: MIpuuSiSZ4.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll

Source: C:\Windows\System32\regsvr32.exe

PE file moved: C:\Windows\System32\GAjjZRZVj\QFdWkQKkPokX.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\loaddll64.exe	File opened: C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 7016	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1032	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

Code function: EnumServicesStatusExW,

2_2_0207DD40

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	API coverage: 9.0 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.1 %

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042F88 FindFirstFileExW,	0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180042F88 FindFirstFileExW,	2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_0000000180043464
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02D2C9F0 FindFirstFileW,FindNextFileW,	12_2_02D2C9F0

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@Hyper-V RAWGlobal\BFE_Notify_Event_{f3c219e5-8073-4743-9b26-35724d75b7c3}LMEM
Source: svchost.exe, 00000020.00000002.649906463.00000298A2700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000007.00000002.661391909.0000017603802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000009.00000002.626869690.000002413A259000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.625682040.0000024134C29000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649489638.00000298A1E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000002.00000003.338636942.0000000000814000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000007.00000002.661773254.0000017603840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.661749128.000001E262629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000000018001360C

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180048198 GetProcessHeap,

0_2_0000000180048198

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0000000180002F14
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000000018001360C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000000018000386C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180003A54 SetUnhandledExceptionFilter,	0_2_0000000180003A54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0000000180002F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000000018001360C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000000018000386C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180003A54 SetUnhandledExceptionFilter,	2_2_0000000180003A54

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 174.138.33.49 7080

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_000000018004C150
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_000000018004C1D4
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_000000018004C2A4
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000000018004C364
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_000000018004C5B0
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_0000000180046664
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000000018004C708
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_0000000180046788
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_000000018004C7DC
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_0000000180046810
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000000018004C908
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_00000001800475F0
Source: C:\Windows\System32\loaddll64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000000018004BE04
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	2_2_000000018004C150
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	2_2_000000018004C1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	2_2_000000018004C2A4
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_000000018004C364
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	2_2_000000018004C5B0
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	2_2_0000000180046664
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_000000018004C708
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	2_2_0000000180046788
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	2_2_000000018004C7DC
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,	2_2_0000000180046810
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_000000018004C908
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	2_2_00000001800475F0
Source: C:\Windows\System32\regsvr32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_000000018004BE04

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180059100 cpuid

0_2_0000000180059100

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00000001800032C0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00000001800032C0

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000014.00000002.662009877.000001B1E9902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000014.00000002.661820829.000001B1E983D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@V%ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Source: Yara match

File source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Emotet

Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	61 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	3 Virtualization/Sandbox Evasion	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Service Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Regsvr32	Proc Filesystem	44 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 DLL Side-Loading	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 File Deletion	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
MIpuuSiSZ4.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MIpuuSiSZ4.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
MIpuuSiSZ4.dll