Edit tour

Windows Analysis Report
MIpuuSiSZ4.dll

Overview

General Information

Sample Name:	MIpuuSiSZ4.dll
Analysis ID:	671702
MD5:	1dd34935a785a419fb552b5086ea682e
SHA1:	c6c966e4ba623f9972273de07b842ffbb9a9efce
SHA256:	8b5a10f9a8f2b25057442111a01faf021ef7e048eab875a4078a44758d952c6f
Tags:	exeOpenCTIBRSandboxed
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Changes security center settings (notifications, updates, antivirus, firewall)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to enumerate running services

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Registers a DLL

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6740 cmdline: loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 6756 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 6776 cmdline: rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 1992 cmdline: C:\Windows\system32\WerFault.exe -u -p 6776 -s 324 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

regsvr32.exe (PID: 6764 cmdline: regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 5660 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 6792 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 3660 cmdline: C:\Windows\system32\WerFault.exe -u -p 6792 -s 328 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

rundll32.exe (PID: 6836 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6852 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 5852 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

svchost.exe (PID: 6880 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6984 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 908 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6380 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1524 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 5112 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 1428 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6256 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 7100 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5604 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["101.69.85.108:20", "200.18.0.0:1", "208.9.0.0:2512", "82.10.0.0:2642", "144.1.49.1:2", "20.7.0.0:1", "176.6.0.0:1", "232.6.0.0:1", "136.6.0.0:1", "24.7.0.0:1", "248.6.0.0:1", "68.7.0.0:1", "80.7.0.0:1", "172.6.0.0:1", "96.7.0.0:1", "84.7.0.0:1", "4.7.0.0:1", "100.7.0.0:1", "112.7.0.0:1", "116.7.0.0:1", "180.6.0.0:1", "8.7.0.0:1", "236.6.0.0:1", "64.7.0.0:1", "204.6.0.0:1"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3		Joe Security
00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.regsvr32.exe.710000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.regsvr32.exe.2cb0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.20000010000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.22fc4510000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.14980010000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.1a029ee0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.0.rundll32.exe.22fc4510000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.1a029ee0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.22fc4510000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.20000010000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.710000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.0.rundll32.exe.14980010000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.14980010000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.regsvr32.exe.2cb0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll64.exe.15738060000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll64.exe.15738060000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 17 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 9 - Source IP: 192.168.2.7 - Destination IP: 174.138.33.49

Timestamp:	192.168.2.7174.138.33.494979470802404316 07/22/22-13:58:44.263207
SID:	2404316
Source Port:	49794
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: MIpuuSiSZ4.dll	Virustotal: Detection: 72%	Perma Link
Source: MIpuuSiSZ4.dll	Metadefender: Detection: 54%	Perma Link
Source: MIpuuSiSZ4.dll	ReversingLabs: Detection: 88%

Antivirus detection for URL or domain

Source: https://174.138.33.49:7080/x	Avira URL Cloud: Label: malware
Source: https://174.138.33.49/T	Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/tem	URL Reputation: Label: malware
Source: https://174.138.33.49:7080/944	Avira URL Cloud: Label: malware

Source: 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["101.69.85.108:20", "200.18.0.0:1", "208.9.0.0:2512", "82.10.0.0:2642", "144.1.49.1:2", "20.7.0.0:1", "176.6.0.0:1", "232.6.0.0:1", "136.6.0.0:1", "24.7.0.0:1", "248.6.0.0:1", "68.7.0.0:1", "80.7.0.0:1", "172.6.0.0:1", "96.7.0.0:1", "84.7.0.0:1", "4.7.0.0:1", "100.7.0.0:1", "112.7.0.0:1", "116.7.0.0:1", "180.6.0.0:1", "8.7.0.0:1", "236.6.0.0:1", "64.7.0.0:1", "204.6.0.0:1"]}

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042F88 FindFirstFileExW,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180042F88 FindFirstFileExW,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02D2C9F0 FindFirstFileW,FindNextFileW,

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 174.138.33.49 7080

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.7:49794 -> 174.138.33.49:7080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 101.69.85.108:20
Source: Malware configuration extractor	IPs: 200.18.0.0:1
Source: Malware configuration extractor	IPs: 208.9.0.0:2512
Source: Malware configuration extractor	IPs: 82.10.0.0:2642
Source: Malware configuration extractor	IPs: 144.1.49.1:2
Source: Malware configuration extractor	IPs: 20.7.0.0:1
Source: Malware configuration extractor	IPs: 176.6.0.0:1
Source: Malware configuration extractor	IPs: 232.6.0.0:1
Source: Malware configuration extractor	IPs: 136.6.0.0:1
Source: Malware configuration extractor	IPs: 24.7.0.0:1
Source: Malware configuration extractor	IPs: 248.6.0.0:1
Source: Malware configuration extractor	IPs: 68.7.0.0:1
Source: Malware configuration extractor	IPs: 80.7.0.0:1
Source: Malware configuration extractor	IPs: 172.6.0.0:1
Source: Malware configuration extractor	IPs: 96.7.0.0:1
Source: Malware configuration extractor	IPs: 84.7.0.0:1
Source: Malware configuration extractor	IPs: 4.7.0.0:1
Source: Malware configuration extractor	IPs: 100.7.0.0:1
Source: Malware configuration extractor	IPs: 112.7.0.0:1
Source: Malware configuration extractor	IPs: 116.7.0.0:1
Source: Malware configuration extractor	IPs: 180.6.0.0:1
Source: Malware configuration extractor	IPs: 8.7.0.0:1
Source: Malware configuration extractor	IPs: 236.6.0.0:1
Source: Malware configuration extractor	IPs: 64.7.0.0:1
Source: Malware configuration extractor	IPs: 204.6.0.0:1

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Joe Sandbox View

IP Address: 174.138.33.49 174.138.33.49

Source: global traffic

TCP traffic: 192.168.2.3:49761 -> 174.138.33.49:7080

Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49

Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.605830890.00000298A2784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z\|\|.\|\|b7e2ac48-308b-4ab0-ad70-c01dd95863e0\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000020.00000003.605789439.00000298A2773000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.605830890.00000298A2784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z\|\|.\|\|b7e2ac48-308b-4ab0-ad70-c01dd95863e0\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649942559.00000298A2711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.662502712.000000000136D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445329795.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000C.00000003.443936950.000000000138D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445018013.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.663236738.000000000350D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445267551.000000000350D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.445153458.00000000034E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e0707f5d6733f
Source: regsvr32.exe, 0000000C.00000002.662226882.000000000132F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabvH
Source: regsvr32.exe, 0000000C.00000003.444256705.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/pXX
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.come
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/T
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/944
Source: regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/tem
Source: regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/x
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000012.00000002.405466984.000002D97084E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405005326.000002D970845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405447191.000002D97083A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000020.00000003.629383351.00000298A279F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

E-Banking Fraud

Source: Yara match

File source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Emotet

Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6776 -s 324

Source: C:\Windows\System32\regsvr32.exe

File deleted: C:\Windows\System32\GAjjZRZVj\QFdWkQKkPokX.dll:Zone.Identifier

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

File created: C:\Windows\system32\ZcjkHmdxs\

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A098
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003E0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800180E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C0F4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E134
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002C150
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A1A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004E1C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800181E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026288
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A2A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800182E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E320
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C324
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180058338
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A3B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800063E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800183F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002E420
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E508
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C510
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028514
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002C51C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018548
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018005A5A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026618
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028668
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004067C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004E6F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C6FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E734
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018758
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800287E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018860
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800548F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002C900
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E91C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C92C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016978
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800189CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026A24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016A80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001EB04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CB18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016B8C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004EBA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018C54
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002CCCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016CE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CD00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001ED30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018D98
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004CEC8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018EC8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016EF8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001EF18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CF2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042F88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018FD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800190D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F104
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D114
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017158
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002D19C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800191E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017260
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D2FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004F2FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F334
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019338
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017474
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002B49C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B4F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D528
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019548
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800175D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002D680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800176D4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F70C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D710
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B724
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004972C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025740
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800197B8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004B7E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017800
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800198C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002B8D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D8FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017908
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B90C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F93C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800199C8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003FA6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019AD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025AD4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001BAF4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017B18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001DB2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002DB50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019C28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017C70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003BD00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001DD18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002BD1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019D30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017D78
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180045A70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019E38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180049EEC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025EFC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001DF04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001BF08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003FF1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019F40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017F88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002DFAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015738050000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987414
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998A804
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999B6BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998FC70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739981B88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998EB08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739975B18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739988B3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739997E28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998BD64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997CCC8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739971014
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998B028
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998406C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739982F94
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998EFAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997DFCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997EFCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997AFE4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992F3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739996F3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739973F40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739978F5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999BE90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739989EC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994EF4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739998EE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983210
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997E254
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D254
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998F238
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399741A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B1A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739975198
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399731F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B0F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998A130
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987144
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999A088
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974078
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399790D4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399730BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999B0EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998A408
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399913FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986418
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999344C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997C458
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399793AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399893E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B3E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999A304
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739993304
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399912FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997D300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994330
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999632C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739971368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739984368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997F290
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B2BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399772E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983610
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998762C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998F61C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992638
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739984594
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986594
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997F580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980578
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C5AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399725D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739996520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999B570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998B558
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999155C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739975484
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998E4A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399814A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D4D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399824E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399984DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972820
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997F850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974848
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998484C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998E7A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399827A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399907D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972708
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739989720
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C720
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983724
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998F764
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399846B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399916A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399976A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997B698
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739976698
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999369C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399736E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739999A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739998990
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739986978
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998D9C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399829BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C9F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399899F4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997D92C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739994918
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974948
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999093C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999796C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739993894
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998C8C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000157399878C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997BC08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987C30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739985C50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992C48
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739990C68
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980C68
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739974C64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983BB4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739977BB4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998ABD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992AFC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739998B28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987B24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739996B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997CB6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997DB74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739980B60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739973A9C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997FAD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739990AC4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739991AE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972AE4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739992E04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739995E30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983E18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997FE58
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998EE5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997ED84
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739987DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739999DA8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739993DD4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739990DBC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739972DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739991D2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573999BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573997BD24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739983D1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739989D5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739977CAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739973CE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001573998ACEC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739978CE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A098
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003E0D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800180E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E134
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002C150
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A1A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004E1C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800181E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180026288
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A2A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800182E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E320
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C324
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180058338
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A3B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800063E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800183F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002E420
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E508
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C510
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180028514
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002C51C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018548
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018005A5A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180026618
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018650
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180028668
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004067C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004E6F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C6FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E734
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018758
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800287E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018860
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016870
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800548F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002C900
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E91C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C92C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016978
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800189CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180026A24
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016A80
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EB04
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018B10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CB18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018C54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002CCCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001ED30
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018D98
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004CEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018EC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EF18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CF2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180042F88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017000
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800190D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F104
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D114
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017158
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002D19C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017260
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D2FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004F2FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B310
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F334
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019338
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017368
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019440
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017474
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002B49C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B4F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F520
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D528
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019548
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800175D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019650
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002D680
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800176D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F70C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D710
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B724
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004972C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025740
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800197B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004B7E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017800
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800198C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002B8D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D8FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017908
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B90C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800199C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017A10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003FA6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019AD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025AD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BAF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DB2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002DB50
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003BD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DD18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002BD1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BD20
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019D30
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017D78
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180045A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017E80
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180049EEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025EFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DF04
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BF08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003FF1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019F40
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180017F88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002DFAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_006C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208B6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02077414
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207EB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02065B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02078B3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02071B88
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207A804
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207C8C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02087E28
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206CCC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207BD64
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02073210
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207F238
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206E254
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207D254
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206F290
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B2BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020672E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020812FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206D300
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208A304
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02083304
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208632C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02084330
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02061368
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02074368
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020693AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B3E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020793E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020813FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02061014
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02084020
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207B028
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02064078
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208A088
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020630BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020690D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208B0EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02076110
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207A130
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02077144
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02065198
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020641A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B1A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020631F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02073610
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207F61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207D620
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207762C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02082638
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02070680
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0208369C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0206B698
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02066698
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020816A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020876A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020746B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020636E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02062708
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02073724
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02079720
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207C720
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207F764
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207E7A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020727A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_020807D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0207A408
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02076418

Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 0000000180046D38 appears 44 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 0000000180046D38 appears 44 times

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll

Source: MIpuuSiSZ4.dll	Virustotal: Detection: 72%
Source: MIpuuSiSZ4.dll	Metadefender: Detection: 54%
Source: MIpuuSiSZ4.dll	ReversingLabs: Detection: 88%

Source: MIpuuSiSZ4.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6776 -s 324
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6792 -s 328
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER31C2.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@33/16@0/28

Source: C:\Windows\System32\loaddll64.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001573998A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,FindCloseChangeNotification,

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6792
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6352:120:WilError_01
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6776

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00000001800011AC LoadStringW,LoadStringW,FindResourceA,LoadResource,LockResource,

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: MIpuuSiSZ4.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MIpuuSiSZ4.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MIpuuSiSZ4.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MIpuuSiSZ4.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000015739978C72 push ebp; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02068C72 push ebp; ret

Source: MIpuuSiSZ4.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll

Source: C:\Windows\System32\regsvr32.exe

PE file moved: C:\Windows\System32\GAjjZRZVj\QFdWkQKkPokX.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\loaddll64.exe	File opened: C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll:Zone.Identifier read attributes \| delete
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll:Zone.Identifier read attributes \| delete

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe TID: 7016	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7020	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1032	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

Code function: EnumServicesStatusExW,

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\loaddll64.exe	API coverage: 9.0 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.1 %

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042F88 FindFirstFileExW,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800427CC _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180042F88 FindFirstFileExW,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043464 FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02D2C9F0 FindFirstFileW,FindNextFileW,

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Source: svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@Hyper-V RAWGlobal\BFE_Notify_Event_{f3c219e5-8073-4743-9b26-35724d75b7c3}LMEM
Source: svchost.exe, 00000020.00000002.649906463.00000298A2700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000007.00000002.661391909.0000017603802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000009.00000002.626869690.000002413A259000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.625682040.0000024134C29000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649489638.00000298A1E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000002.00000003.338636942.0000000000814000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000007.00000002.661773254.0000017603840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.661749128.000001E262629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180048198 GetProcessHeap,

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180003A54 SetUnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180002F14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001360C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000386C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180003A54 SetUnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 174.138.33.49 7080

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180059100 cpuid

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00000001800032C0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000014.00000002.662009877.000001B1E9902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000014.00000002.661820829.000001B1E983D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@V%ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Source: Yara match

File source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Emotet

Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.22fc4510000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1a029ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.22fc4510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.20000010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.rundll32.exe.14980010000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.14980010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.15738060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	61 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	3 Virtualization/Sandbox Evasion	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Service Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Regsvr32	Proc Filesystem	44 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 DLL Side-Loading	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 File Deletion	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MIpuuSiSZ4.dll	72%	Virustotal		Browse
MIpuuSiSZ4.dll	54%	Metadefender		Browse
MIpuuSiSZ4.dll	88%	ReversingLabs	Win64.Trojan.Emotet

Source	Detection	Scanner	Label
https://174.138.33.49/	0%	URL Reputation	safe
https://174.138.33.49:7080/	0%	URL Reputation	safe
https://www.pango.co/privacy	0%	URL Reputation	safe
https://174.138.33.49:7080/x	100%	Avira URL Cloud	malware
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://174.138.33.49/T	100%	Avira URL Cloud	malware
https://174.138.33.49:7080/tem	100%	URL Reputation	malware
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://174.138.33.49:7080/944	100%	Avira URL Cloud	malware
https://disneyplus.com/legal.	0%	URL Reputation	safe
https://%s.xboxlive.come	0%	Avira URL Cloud	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://174.138.33.49/	regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000012.00000002.405457932.000002D970842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405017263.000002D970841000.00000004.00000020.00020000.00000000.sdmp	false		high
https://174.138.33.49:7080/	regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.hotspotshield.com/terms/	svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pango.co/privacy	svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp	false		high
https://174.138.33.49:7080/x	regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://174.138.33.49/T	regsvr32.exe, 0000000C.00000002.661956267.0000000001301000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444203872.0000000001301000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.405005326.000002D970845000.00000004.00000020.00020000.00000000.sdmp	false		high
https://174.138.33.49:7080/tem	regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.626913081.000002413A266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.649749481.00000298A1EEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404980940.000002D970840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000020.00000003.629383351.00000298A279F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000012.00000002.405412295.000002D970813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405452602.000002D97083D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000012.00000002.405466984.000002D97084E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.hotspotshield.com/	svchost.exe, 00000020.00000003.620490256.00000298A2781000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620519716.00000298A2C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620333446.00000298A279D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620402747.00000298A2C02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620475663.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620374463.00000298A27AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.620430135.00000298A2C03000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000012.00000003.404854812.000002D970849000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://174.138.33.49:7080/944	regsvr32.exe, 0000000C.00000002.661740445.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.444163231.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://disneyplus.com/legal.	svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000012.00000003.383087363.000002D970831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.405447191.000002D97083A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.xboxlive.come	svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000012.00000003.404914654.000002D970861000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 00000020.00000003.627116814.00000298A279A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://%s.dnet.xboxlive.com	svchost.exe, 00000010.00000002.661987254.000002D0F6641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000012.00000002.405473479.000002D97085C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000012.00000003.404945537.000002D97085A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
174.138.33.49	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
248.6.0.0	unknown	Reserved	unknown	unknown	true
20.7.0.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
101.69.85.108	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
176.6.0.0	unknown	Germany	12638	AS12638DuesseldorfDE	true
144.1.49.1	unknown	unknown	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	true
80.7.0.0	unknown	United Kingdom	5089	NTLGB	true
64.7.0.0	unknown	United States	4565	MEGAPATH2-US	true
24.7.0.0	unknown	United States	7922	COMCAST-7922US	true
112.7.0.0	unknown	China	24444	CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany	true
4.7.0.0	unknown	United States	3356	LEVEL3US	true
208.9.0.0	unknown	United States	1239	SPRINTLINKUS	true
232.6.0.0	unknown	Reserved	unknown	unknown	true
96.7.0.0	unknown	United States	262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	true
204.6.0.0	unknown	United States	174	COGENT-174US	true
172.6.0.0	unknown	United States	7018	ATT-INTERNET4US	true
100.7.0.0	unknown	United States	701	UUNETUS	true
180.6.0.0	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
84.7.0.0	unknown	France	8228	CEGETEL-ASFR	true
200.18.0.0	unknown	Brazil	10715	UniversidadeFederaldeSantaCatarinaBR	true
136.6.0.0	unknown	United States	60311	ONEFMCH	true
236.6.0.0	unknown	Reserved	unknown	unknown	true
68.7.0.0	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
116.7.0.0	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	true
8.7.0.0	unknown	United States	3356	LEVEL3US	true
82.10.0.0	unknown	United Kingdom	5089	NTLGB	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	671702
Start date and time: 22/07/202214:09:07	2022-07-22 14:09:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 25s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	MIpuuSiSZ4.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@33/16@0/28
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 86.9% (good quality ratio 81.6%) Quality average: 75% Quality standard deviation: 30.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Adjust boot time Enable AMSI Sleeps bigger than 300000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, WmiPrvSE.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.35.236.56, 93.184.221.240, 52.182.143.212, 20.189.173.21, 173.222.108.226, 173.222.108.210, 20.223.24.244
Excluded domains from analysis (whitelisted): a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, wu.azureedge.net, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, onedsblobprdwus16.westus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, wu.ec.azureedge.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.2494601363776735
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4Z:BJiRdwfu2SRU4Z
MD5:	70A5B7D8E2DEE8170DC1E083CCA3CE17
SHA1:	F3B8F17368F39ED7713E65721C93D6D3B7B9A2C2
SHA-256:	8D6AA38C684CD3C65C1F854E1B31676DD9E332B2134F06DF5BCCB0D91689F781
SHA-512:	A6C3D29A63E811A0CE4BEDD374CA271ED825E4FAA61B301FCE12B7BE26618BE99DAD311B4DCF521A304457744DDA18FFAE216563A93ABBC0B136C523F0D9AF1F
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9fe2e37f, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2505993140506313
Encrypted:	false
SSDEEP:	384:Ax9xz+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:An+SB2nSB2RSjlK/+mLesOj1J2
MD5:	19F8855F774735CCC8BCE5F79ED231B6
SHA1:	C105EA75CC9D92EBD60BF55AE5522FEE898489B9
SHA-256:	12C3290682DD6BB02DC0360DC3DA9575C5C400597D69DEECACE4DC70F99E5917
SHA-512:	E7EC65EB221DE16E577EAFE4E7174E4740786B50A210183903AC6751DABC1E2D85067CD8FDFD3FB02B44291F3CDA85AE105B74AC4103497BC935DA2091BD9301
Malicious:	false
Preview:	....... ................e.f.3...w........................)..........z..0....z..h.(..........z....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................oXl0.....z...................`k......z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07550297560210162
Encrypted:	false
SSDEEP:	3:S+llJ7vVtulfwOGgAmmtOfyQllRB8ewll3Vkttlmlnl:S+/Jr/ulAgAmYwhlRB8eQ3
MD5:	CD01E4F23E04035414BA9B9633F9F1EF
SHA1:	EFE4C001C27E9C473AC3A4B7C8471E215781E2A1
SHA-256:	DE5735C8E68FAA5BBB3AD2934EAB9B2E8103ACCF6E22179CDDC14081F9FE9558
SHA-512:	C2BDCD9E6EA1411D7D1E58D8961BF473FA39499F1633C61EAA357EE6CFCFF43E2174AC9704743176EF18DC4E9BC64BE47185C4B3C6A07C2AF594F347D8F61060
Malicious:	false
Preview:	..Lf.....................................3...w..0....z.......z...............z.......z...._......z.u.................`k......z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_MIp_773949b15a9dc27bfcd3f791ccbc8dda8da3511_ceeedb37_0e0d5ce9\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7738439296664732
Encrypted:	false
SSDEEP:	192:8pHrig1JKvHkhyJdJsj9U/u7s8S274ltN:wHriOKvkEJdJsjO/u7s8X4ltN
MD5:	7DC9F73DEF29002E1206FA23948F2E42
SHA1:	1514D0E4D04F00199CB62E657FE2EEA370DD278D
SHA-256:	A63786AA6434919A07EA05F40E5E86AEC6326D065C90A85C2F81BD5E2F0009B1
SHA-512:	E7E95D086D06B780D7C2121D3A3EC1812005AE0AE10E9E598A3AE2E9F82865D5AD004073569199730AAF6CBE21F997059B4363EBFBE2AB2C09A9BFC4B98E6269
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.2.9.9.7.8.6.2.3.6.3.9.9.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.2.9.9.7.8.6.7.0.6.7.1.0.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.f.d.1.8.f.3.-.2.0.b.a.-.4.f.f.0.-.b.8.5.1.-.e.6.d.5.0.c.c.5.7.e.9.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.b.d.5.e.7.7.-.0.1.0.e.-.4.3.a.4.-.9.b.0.c.-.e.9.2.b.6.9.3.7.f.a.a.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.M.I.p.u.u.S.i.S.Z.4...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.8.8.-.0.0.0.1.-.0.0.1.d.-.2.f.2.5.-.c.1.7.2.0.f.9.e.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_MIp_aa8bb9fdf8d32e2840ca8df43968d536d04b9a9_ceeedb37_07895910\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7729218762588249
Encrypted:	false
SSDEEP:	96:krgFa4QidJPnyEjT55I73f2pXIQcQqc620ycEBcw3pXaXz+HbHgSQgJPbmIDV9wR:ggOidJKgHkhyLtj9U/u7s8S274ltN3
MD5:	311D9D5DD757DFFCA2D4B6C46870D415
SHA1:	99417DC19B7ACFA4A69EEB8AAFAA08B956B455C4
SHA-256:	AFFA8D1168A1B8417E115A4B9C95BA8A68AD43287E0798545D518E72A72DFC1E
SHA-512:	2B8E6A134F98417A238288016E0F6B8D4073BEC251AC2589286FCAD00B2937F0523565819368C81CFB3EE1F047B0DD8426BB463976ECC14059179F0F0A89B1C5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.2.9.9.7.8.6.0.1.1.9.1.7.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.2.9.9.7.8.6.4.3.2.2.2.6.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.5.5.5.f.c.8.-.f.c.e.3.-.4.7.2.d.-.a.0.f.9.-.e.9.0.7.3.d.7.5.6.3.2.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.b.a.4.b.d.2.-.e.1.e.3.-.4.f.4.b.-.a.5.f.f.-.c.e.f.c.2.6.6.0.b.7.5.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.M.I.p.u.u.S.i.S.Z.4...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.7.8.-.0.0.0.1.-.0.0.1.d.-.6.0.7.b.-.8.0.7.2.0.f.9.e.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31C2.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Jul 22 21:11:02 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	62478
Entropy (8bit):	2.362625578819154
Encrypted:	false
SSDEEP:	384:MQj1V4z7BXVjaYCr9x1lwdW4EaoO0w52SF8l:MQjz4xrCRxrqW4Ea7ZF6
MD5:	04E27A5A5CD926209E9DF3277BFD5568
SHA1:	B0F8A53B134CDCCB30E1950AE5DF92D52741CA2C
SHA-256:	1A3DF93B9CF4E8B649F71E40438CFD3D809684B16DB6C70BD278D4967FF7A39D
SHA-512:	8E5BA9B91ABABC7EE1363CA9D6E99DFD8ED770C4837FB56CCE3233AB27B9912CB6768FD3478F5CA487C29BDC0E5347F8D88ACD9917FAD162F55C609CCB985C4C
Malicious:	false
Preview:	MDMP....... .......f..b....................................h...8.......D...8:..........`.......8...........T...........0................!...........#...................................................................U...........B......$$......Lw..................S...T.......x...;..b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A8C.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Jul 22 21:11:04 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	64482
Entropy (8bit):	2.303579767806309
Encrypted:	false
SSDEEP:	384:DjWV4z7BXVjaaCmys8FqDMtlwdWke1EFfV6n+lk:DjI4xBC5q3e1EC
MD5:	B91B0DF6830BF2C08315A77C6D835667
SHA1:	E87AC87670539F0D814421700F853EA438EF304E
SHA-256:	8AD8C29581A4743FEF9C7C2772FB721797C5017052C86EF3EDB3368198D26345
SHA-512:	E0ACE2FBDFFA43B82BFE9DD19E652607248607D5C1BA457E41A85F6468797DE37E7DA2F3F704676D4255A2259518865E478413B43AB6995F47A89017A685F9A3
Malicious:	false
Preview:	MDMP....... .......h..b....................................h...8.......D...8:..........`.......8...........T............................!...........#...................................................................U...........B......$$......Lw................h.....T...........;..b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DB9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8748
Entropy (8bit):	3.6996177533951498
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNilDfCzG6Yx+Ygmf1RS/sCpr989bnhFhKfQtm:RrlsNiBfCS6YIYgmf1RSmnhFsf3
MD5:	76CC5955C86EA809660608C5BA848DAC
SHA1:	EDACA74055FDD4B7342A3ACEA1D0ECC7C76FE968
SHA-256:	F43D48F38CFECA62BAA7A6DF8C5563926432D4B4A754E320D6A219E829943282
SHA-512:	CBD881EC4AADF1D34AAE9991AFD750B7047515F28F000B3E6102EB8E7A3662DB5A34DD985E5974044ED7108AAB56CE6ED3DEC5415B86B604721B9A3F99BBE921
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.7.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3FAE.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4733
Entropy (8bit):	4.487431331312363
Encrypted:	false
SSDEEP:	48:cvIwSD8zsLJgtBI9LLWgc8sqYjws8fm8M4JC/WC/J8Frbyq85m/E7ZESC5Sh6d:uITflN6grsqYURJ8bWb9+Vvh6d
MD5:	F022773265E899347C4417FE0AA02F68
SHA1:	DB1D3257D2301DFFF5014571A7DC99147CA3754F
SHA-256:	36AFA68F591F873B69550113030DE17EDC4B060E0F99CCBD34D9DC82D80E3EA5
SHA-512:	BA50C2B624639284BFD2351870F05BBBD28D2254857C123EC0E684C9687C941A6F7E91F59C1DB955712E357D1A0DD2BE2E79ED75D0545BD2DBBF0CF9F106D577
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1614621" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43B4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8780
Entropy (8bit):	3.7010000674473056
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiPCyC86YUNC5LOgmf15S/3JPCprZ89bIYSfok4m:RrlsNi6yC86Y+C5LOgmf15SvJxItfo6
MD5:	E5C28F8EEFAB76EF6FD043E7608A16E4
SHA1:	32F14F79BEF26CC67FE114647893CC62A07A196D
SHA-256:	3C0CC2A7F21369758FF51B4B2C18961FB3041FC6129B15DF9401065054CAB076
SHA-512:	F9422786CB0A3018399FB284062E99C5043CCD5AAA980A887C365455816FE15B3E9A6D04CCFB0D108F4C3865F95ABC0DB8DC2C482AD386651FAF12CAC0886245
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.9.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4675.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4733
Entropy (8bit):	4.487281289926747
Encrypted:	false
SSDEEP:	48:cvIwSD8zsLJgtBI9LLWgc8sqYjS8fm8M4JC/WC/JsFAqyq85m/EsTZESC5Sld:uITflN6grsqYbJ8bU9vTVvld
MD5:	400AF3467BEA945FF08EEEEA48E212D4
SHA1:	0B3A96CCE356B960C83CBC001F9FB855441B408D
SHA-256:	D9870892CC9112382DBAD15D17931C7EC4CE4181B1F5237AA1F3C9B8F4BFDF88
SHA-512:	CC70BD271678E3EAA94366FB7F5940F59FCAB8B5BF4C395DC1D4FBD78DA8C4D174D8A619A3328715416501C50AA7A6C4FA9A1BA958F32ABDC4611FA38676D9C9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1614621" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61712 bytes, 1 file
Category:	dropped
Size (bytes):	61712
Entropy (8bit):	7.995044632446497
Encrypted:	true
SSDEEP:	1536:gzjJiDImMsrjCtGLaexX/zL09mX/lZHIxs:gPJiDI/sr0Hexv/0S/zx
MD5:	589C442FC7A0C70DCA927115A700D41E
SHA1:	66A07DACE3AFBFD1AA07A47E6875BEAB62C4BB31
SHA-256:	2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
SHA-512:	1B5FA79E52BE495C42CF49618441FB7012E28C02E7A08A91DA9213DB3AB810F0E83485BC1DD5F625A47D0BA7CFCDD5EA50ACC9A8DCEBB39F048C40F01E94155B
Malicious:	false
Preview:	MSCF............,...................I........y.........Tf. .authroot.stl..W.`.4..CK..8U[...q.yL'sf!d.D..."2.2g.<dVI.!.....$).\...!2s..(...[.T7..{}...g....g.....w.km$.&\|..qe.n.8+..&...O...`...+..C......`h!0.I.(C..1Q*L.p..".s..B.....H......fUP@..5...(X#.t.2lX.>.y\|D.0Z0...M....I(.#.-... ...(.J....2..`.hO..{l+.bd7y.j..u.....3....<......3....s.T...._.'...%{v...s..............KgV.0..X=.A.9w9.Ea.x..........\.=.e.C2......9.......`.o... .......@pm.. a.....-M.....{...s.mW.....;.+...A......0.g..L9#.v.&O>./xSH.S.....GH.6.j...`2.(0g..... Lt........h4.iQ?....[.K.....uI......}.....d....M.....6q.Q~.0.\.'U^)`..u.....-........d..7...2.-.2+3.....A./.%Q...k...Q.,...H.B.%..O..x..5\...Hk.......B.';"Ym.'....X.l.E.6..a8.6..nq..x.r4..1t.....,..u.O..O.L...Uf...X.u.F .(.(.....".q...n{%U.-u....l6!....Z....~o0.}Q'.s.i....7...>4x...A.h.Mk].O.z.].6...53...b^;..>e..x.'1..\p.O.k..B1w..\|..K.R.....2.e0..X.^...I...w..!.v5B]x..z.6.G^uF..].b.W...'..I.;..p..@L{.E..@W..3.&...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.135891594007862
Encrypted:	false
SSDEEP:	6:kKDu+N+SkQlPlEGYRMY9z+4KlDA3RUeWlEZ21:6NkPlE99SNxAhUeE1
MD5:	393A75620FA9245A499CC73005C86D0E
SHA1:	556A243C5C445F94D53A27B455BB4C5997DA58B8
SHA-256:	074F48DB61AAE7BAE1D2CB0A71B962643B737A4B82A2EE57E3D1BA81C69F0937
SHA-512:	1BD9CD7B547AAC9F141E3BE355598CA09DA13A12318087C9B59E685E752BF01B0F7F3CD2264870457661378C507A14B3FFE58478EAAE2E0F494EE867E47D57EC
Malicious:	false
Preview:	p...... ...............(....................................................... .........L.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.9.f.4.c.9.6.9.8.b.d.8.1.:.0."...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1630398757988987
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3zEy+fs:j+s+v+b+P+m+0+Q+q+I+k
MD5:	79C0D9DDA6271582B2DD5E96FD072C8F
SHA1:	C6E2EFC633A02091186D2EEF6B6E6D9728BB8C20
SHA-256:	F0AAA959E0E482063E0A73C441F227AD4D89864BB1369BD9F04DCE2416064DBB
SHA-512:	985C3595CBC558823F96682BA09945350EEB386D76299E438F705099AC7ADADBACCBB1BC941C7A1C9041CBC4643416ACFB94362B7537D6109C6DD8B5EC9B48F5
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.372720093100094
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	MIpuuSiSZ4.dll
File size:	850944
MD5:	1dd34935a785a419fb552b5086ea682e
SHA1:	c6c966e4ba623f9972273de07b842ffbb9a9efce
SHA256:	8b5a10f9a8f2b25057442111a01faf021ef7e048eab875a4078a44758d952c6f
SHA512:	79ab4a827fd581cd87fad4b0470bfcaf26f9471181c6c199706c54cc1b636cc7719306feac1b50c24d051f65c3b4d84bc662b8e33c03a1fced07f8023689dcfc
SSDEEP:	12288:jRCGXj4KVB9abMfyzfqvHWnyPv+LVHT2+2JNdX712kBjtOJZObrGzifb97Vw+Uvf:kGXj3X7FjkZqrqiBVwDbu5nP2F
TLSH:	7005D06773A509B5E0B7D139CA128E86FAB2BC091720F74B03E495752F23750A67F722
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..t7..t7..t7w.w6..t7w.q6!.t7w.p6..t7..q6..t7..p6..t7..w6..t7w.u6..t7..u7..t7e.q6..t7e.t6..t7e..7..t7...7..t7e.v6..t7Rich..t

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x180002c54
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT
Time Stamp:	0x62CC7629 [Mon Jul 11 19:12:41 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c2b03f92959f67ac494853faf0032582

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FD5E8C48D07h
call 00007FD5E8C493BCh
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FD5E8C48B70h
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0005B5E0h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
dec eax
mov dword ptr [ecx+08h], edx
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0005B591h]
xorps xmm0, xmm0
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
dec eax
lea ecx, dword ptr [eax+08h]
movups dqword ptr [edx], xmm0
call 00007FD5E8C4AAD0h
dec eax
lea eax, dword ptr [0005B5A4h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0005B59Ch]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0005B581h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0005B535h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x6eeb0	0x414	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6f2c4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x79000	0x5b020	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x73000	0x4638	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd5000	0x80c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x687c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x687e0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5d000	0x338	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5b4c0	0x5b600	False	0.39445376624487005	data	6.495530086549807	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5d000	0x12dae	0x12e00	False	0.39502276490066224	data	5.29311907790045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x70000	0x2740	0xe00	False	0.17606026785714285	data	2.4721317906474725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x73000	0x4638	0x4800	False	0.5061848958333334	data	5.700987254121771	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x78000	0xf4	0x200	False	0.306640625	data	1.9910589321100538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x79000	0x5b020	0x5b200	False	0.9233324759945131	data	7.923209381955667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd5000	0x80c	0xa00	False	0.453515625	data	4.916763645477666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_HTML	0x790a0	0x5ae00	data	English	United States
RT_MANIFEST	0xd3ea0	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	LockResource, CreateFileW, OutputDebugStringW, LoadResource, GetModuleFileNameW, VirtualAllocExNuma, WriteConsoleW, FindResourceA, GetCurrentProcess, CloseHandle, ReadConsoleW, ReadFile, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, ExitProcess, GetModuleHandleExW, GetCurrentThread, HeapFree, HeapAlloc, GetStdHandle, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetProcessHeap, SetConsoleCtrlHandler, GetStringTypeW, GetFileSizeEx, SetFilePointerEx, SetStdHandle, HeapSize, HeapReAlloc, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, RtlUnwind
USER32.dll	LoadStringW
ADVAPI32.dll	RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, RegSetValueExW
ole32.dll	StringFromCLSID, CoTaskMemFree

Exports

Name	Ordinal	Address
AddStroke	2	0x180001744
AddWordsToWordList	3	0x180001970
AdviseInkChange	4	0x180001978
CloneContext	5	0x18000197c
CreateContext	6	0x180001984
CreateRecognizer	7	0x1800019ec
DestroyAlternate	8	0x180001a54
DestroyContext	9	0x180001a5c
DestroyRecognizer	10	0x180001ac4
DestroyWordList	11	0x180001ae8
DllRegisterServer	12	0x180001e0c
DllUnregisterServer	13	0x180001fc0
GetBestResultString	1	0x1800010b8
GetContextPreferenceFlags	14	0x18000201c
GetContextPropertyList	15	0x180002024
GetContextPropertyValue	16	0x18000202c
GetEnabledUnicodeRanges	17	0x180002034
GetGuide	18	0x18000203c
GetLatticePtr	19	0x180002080
GetLeftSeparator	20	0x1800022a4
GetPreferredPacketDescription	21	0x1800022ac
GetRecoAttributes	22	0x180002328
GetResultPropertyList	23	0x180002340
GetRightSeparator	24	0x180002348
GetUnicodeRanges	25	0x180002350
IsStringSupported	26	0x180002358
MakeWordList	27	0x180002360
Process	28	0x180002368
ResetContext	29	0x180002688
SetCACMode	30	0x1800026e0
SetContextPropertyValue	31	0x1800026e8
SetEnabledUnicodeRanges	32	0x1800026f0
SetFactoid	33	0x1800026f8
SetFlags	34	0x1800026fc
SetGuide	35	0x180002700
SetTextContext	36	0x1800027a8
SetWordList	37	0x1800027b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.7174.138.33.494979470802404316 07/22/22-13:58:44.263207	TCP	2404316	ET CNC Feodo Tracker Reported CnC Server TCP group 9	49794	7080	192.168.2.7	174.138.33.49

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2022 14:11:39.982661963 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:40.086760998 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:40.086891890 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:40.112767935 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:40.215147972 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:40.233104944 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:40.233135939 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:40.233262062 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:42.999223948 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:43.104422092 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:43.105884075 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:43.111108065 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:43.250535965 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:43.646327019 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:43.648586035 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:11:46.647919893 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:46.647969007 CEST	7080	49761	174.138.33.49	192.168.2.3
Jul 22, 2022 14:11:46.648163080 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:13:29.858473063 CEST	49761	7080	192.168.2.3	174.138.33.49
Jul 22, 2022 14:13:29.858508110 CEST	49761	7080	192.168.2.3	174.138.33.49

Target ID:	0
Start time:	14:10:18
Start date:	22/07/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll"
Imagebase:	0x7ff682600000
File size:	140288 bytes
MD5 hash:	4E8A40CAD6CCC047914E3A7830A2D8AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.364452628.0000015738060000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.364805521.0000015739971000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: cmd.exePID: 6756, Parent PID: 6740

General

Target ID:	1
Start time:	14:10:18
Start date:	22/07/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Imagebase:	0x7ff689bc0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 6764, Parent PID: 6740

General

Target ID:	2
Start time:	14:10:19
Start date:	22/07/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll
Imagebase:	0x7ff6da7e0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.345850399.0000000000710000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.346021007.0000000002061000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6776, Parent PID: 6756

General

Target ID:	3
Start time:	14:10:19
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1
Imagebase:	0x7ff643150000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000000.348541554.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.377797661.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000000.348813253.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000000.338942505.0000022FC4510000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.377880147.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000000.338998123.0000022FC4571000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6792, Parent PID: 6740

General

Target ID:	4
Start time:	14:10:19
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke
Imagebase:	0x7ff643150000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.378702987.0000014980010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.378747717.0000014980071000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.352241442.0000014980010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.345097590.0000014980010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.349632978.0000014980071000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.352325443.0000014980071000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6836, Parent PID: 6740

General

Target ID:	5
Start time:	14:10:24
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList
Imagebase:	0x7ff643150000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.351700174.0000020000071000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.351638703.0000020000010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6852, Parent PID: 6740

General

Target ID:	6
Start time:	14:10:28
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange
Imagebase:	0x7ff643150000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.358968494.000001A029F41000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.358868561.000001A029EE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: svchost.exePID: 6880, Parent PID: 568

General

Target ID:	7
Start time:	14:10:30
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exePID: 6984, Parent PID: 568

General

Target ID:	9
Start time:	14:10:45
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: regsvr32.exePID: 5660, Parent PID: 6764

General

Target ID:	12
Start time:	14:10:54
Start date:	22/07/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GAjjZRZVj\QFdWkQKkPokX.dll"
Imagebase:	0x7ff6da7e0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.662977936.0000000002D11000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.662715077.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_3, Description: , Source: 0000000C.00000002.661348004.0000000001298000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Analysis Process: WerFault.exePID: 1992, Parent PID: 6776

General

Target ID:	13
Start time:	14:10:58
Start date:	22/07/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6776 -s 324
Imagebase:	0x7ff61dc30000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 3660, Parent PID: 6792

General

Target ID:	14
Start time:	14:11:00
Start date:	22/07/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6792 -s 328
Imagebase:	0x7ff61dc30000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: regsvr32.exePID: 5852, Parent PID: 6740

General

Target ID:	15
Start time:	14:11:03
Start date:	22/07/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZcjkHmdxs\qpwRIIkrlFzB.dll"
Imagebase:	0x7ff6da7e0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 908, Parent PID: 568

General

Target ID:	16
Start time:	14:11:04
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 6380, Parent PID: 568

General

Target ID:	17
Start time:	14:11:11
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 1524, Parent PID: 568

General

Target ID:	18
Start time:	14:11:13
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: SgrmBroker.exePID: 5112, Parent PID: 568

General

Target ID:	19
Start time:	14:11:13
Start date:	22/07/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7b9e90000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 1428, Parent PID: 568

General

Target ID:	20
Start time:	14:11:14
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 7100, Parent PID: 568

General

Target ID:	21
Start time:	14:11:32
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 5604, Parent PID: 568

General

Target ID:	23
Start time:	14:12:03
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: MpCmdRun.exePID: 6256, Parent PID: 1428

General

Target ID:	26
Start time:	14:12:15
Start date:	22/07/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7a3c50000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6352, Parent PID: 6256

General

Target ID:	27
Start time:	14:12:15
Start date:	22/07/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 3308, Parent PID: 568

General

Target ID:	29
Start time:	14:12:29
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 3052, Parent PID: 568

General

Target ID:	32
Start time:	14:12:50
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MIpuuSiSZ4.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_MIp_773949b15a9dc27bfcd3f791ccbc8dda8da3511_ceeedb37_0e0d5ce9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_MIp_aa8bb9fdf8d32e2840ca8df43968d536d04b9a9_ceeedb37_07895910\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31C2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A8C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DB9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3FAE.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43B4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4675.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Static File Info

Windows Analysis Report
MIpuuSiSZ4.dll

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre