Windows Analysis Report
yoyrJ.dll

Overview

General Information

Sample Name: yoyrJ.dll
Analysis ID: 750476
MD5: dd7105e9748a29b5bd61ea57214d57e3
SHA1: 827b323bda769ba7fb838a231aa4160209266b14
SHA256: c987ad0cc79b598bdee9ec7da96b07e82a04cadd73cb3caf85b799731deef9a1
Infos:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Creates an autostart registry key pointing to binary in C:\Windows
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file contains an invalid checksum
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Registers a DLL
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: yoyrJ.dll ReversingLabs: Detection: 88%
Source: yoyrJ.dll Metadefender: Detection: 47% Perma Link
Antivirus detection for URL or domain
Source: https://45.63.99.23:7080/ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/ Avira URL Cloud: Label: malware
Source: 00000007.00000002.827986155.0000000000C38000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["173.255.211.88:443", "45.63.99.23:7080", "182.162.143.56:443", "91.187.140.35:8080", "212.24.98.99:8080", "119.59.103.152:8080", "45.235.8.30:8080", "172.104.251.154:8080", "72.15.201.15:8080", "169.57.156.166:8080", "103.75.201.2:443", "213.239.212.5:443", "164.90.222.65:443", "201.94.166.162:443", "94.23.45.86:4143", "183.111.227.137:8080", "186.194.240.217:443", "107.170.39.149:8080", "147.139.166.154:8080", "5.135.159.50:443", "206.189.28.199:8080", "104.168.155.143:8080", "129.232.188.93:443", "82.223.21.224:8080", "103.43.75.120:443", "103.132.242.26:8080", "139.59.56.73:8080", "164.68.99.3:8080", "202.129.205.3:8080", "167.172.199.165:8080", "110.232.117.186:8080", "209.97.163.214:443", "167.172.253.162:8080", "1.234.2.232:8080", "159.65.88.10:8080", "95.217.221.146:8080", "153.92.5.27:8080", "91.207.28.33:8080", "188.44.20.25:443", "153.126.146.25:7080", "163.44.196.120:8080", "172.105.226.75:8080", "115.68.227.76:8080", "159.65.140.115:443", "139.59.126.41:443", "197.242.150.244:8080", "45.176.232.124:443", "45.118.115.99:8080", "149.56.131.28:8080", "79.137.35.198:8080", "173.212.193.249:8080", "160.16.142.56:8080", "159.89.202.34:443", "185.4.135.165:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5J0rtUQAbAIw=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2AkoOUQAUAJA="]}
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.4:49700 version: TLS 1.2
Source: yoyrJ.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 7_2_000000018001E0D4

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 45.63.99.23 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.255.211.88 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.4:49700 -> 182.162.143.56:443
Source: Traffic Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.4:49695 -> 173.255.211.88:443
Source: Traffic Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.4:49699 -> 45.63.99.23:7080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 173.255.211.88:443
Source: Malware configuration extractor IPs: 45.63.99.23:7080
Source: Malware configuration extractor IPs: 182.162.143.56:443
Source: Malware configuration extractor IPs: 91.187.140.35:8080
Source: Malware configuration extractor IPs: 212.24.98.99:8080
Source: Malware configuration extractor IPs: 119.59.103.152:8080
Source: Malware configuration extractor IPs: 45.235.8.30:8080
Source: Malware configuration extractor IPs: 172.104.251.154:8080
Source: Malware configuration extractor IPs: 72.15.201.15:8080
Source: Malware configuration extractor IPs: 169.57.156.166:8080
Source: Malware configuration extractor IPs: 103.75.201.2:443
Source: Malware configuration extractor IPs: 213.239.212.5:443
Source: Malware configuration extractor IPs: 164.90.222.65:443
Source: Malware configuration extractor IPs: 201.94.166.162:443
Source: Malware configuration extractor IPs: 94.23.45.86:4143
Source: Malware configuration extractor IPs: 183.111.227.137:8080
Source: Malware configuration extractor IPs: 186.194.240.217:443
Source: Malware configuration extractor IPs: 107.170.39.149:8080
Source: Malware configuration extractor IPs: 147.139.166.154:8080
Source: Malware configuration extractor IPs: 5.135.159.50:443
Source: Malware configuration extractor IPs: 206.189.28.199:8080
Source: Malware configuration extractor IPs: 104.168.155.143:8080
Source: Malware configuration extractor IPs: 129.232.188.93:443
Source: Malware configuration extractor IPs: 82.223.21.224:8080
Source: Malware configuration extractor IPs: 103.43.75.120:443
Source: Malware configuration extractor IPs: 103.132.242.26:8080
Source: Malware configuration extractor IPs: 139.59.56.73:8080
Source: Malware configuration extractor IPs: 164.68.99.3:8080
Source: Malware configuration extractor IPs: 202.129.205.3:8080
Source: Malware configuration extractor IPs: 167.172.199.165:8080
Source: Malware configuration extractor IPs: 110.232.117.186:8080
Source: Malware configuration extractor IPs: 209.97.163.214:443
Source: Malware configuration extractor IPs: 167.172.253.162:8080
Source: Malware configuration extractor IPs: 1.234.2.232:8080
Source: Malware configuration extractor IPs: 159.65.88.10:8080
Source: Malware configuration extractor IPs: 95.217.221.146:8080
Source: Malware configuration extractor IPs: 153.92.5.27:8080
Source: Malware configuration extractor IPs: 91.207.28.33:8080
Source: Malware configuration extractor IPs: 188.44.20.25:443
Source: Malware configuration extractor IPs: 153.126.146.25:7080
Source: Malware configuration extractor IPs: 163.44.196.120:8080
Source: Malware configuration extractor IPs: 172.105.226.75:8080
Source: Malware configuration extractor IPs: 115.68.227.76:8080
Source: Malware configuration extractor IPs: 159.65.140.115:443
Source: Malware configuration extractor IPs: 139.59.126.41:443
Source: Malware configuration extractor IPs: 197.242.150.244:8080
Source: Malware configuration extractor IPs: 45.176.232.124:443
Source: Malware configuration extractor IPs: 45.118.115.99:8080
Source: Malware configuration extractor IPs: 149.56.131.28:8080
Source: Malware configuration extractor IPs: 79.137.35.198:8080
Source: Malware configuration extractor IPs: 173.212.193.249:8080
Source: Malware configuration extractor IPs: 160.16.142.56:8080
Source: Malware configuration extractor IPs: 159.89.202.34:443
Source: Malware configuration extractor IPs: 185.4.135.165:8080
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU
Source: Joe Sandbox View ASN Name: INPL-IN-APIshansNetworkIN INPL-IN-APIshansNetworkIN
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 8916410db85077a5460817142dcbc8de
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 334Host: 182.162.143.56
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 110.232.117.186 110.232.117.186
Source: Joe Sandbox View IP Address: 103.132.242.26 103.132.242.26
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49699 -> 45.63.99.23:7080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 20
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 173.255.211.88
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 45.63.99.23
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: regsvr32.exe, 00000007.00000003.455831993.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456335668.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828167119.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000007.00000003.585372915.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828083663.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585447802.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585835870.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584690393.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456292772.0000000000C91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://17.63.99.23:7080/
Source: regsvr32.exe, 00000007.00000003.585862169.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828134623.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584870026.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456389200.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456205938.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584908649.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/
Source: regsvr32.exe, 00000007.00000003.585426852.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585862169.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828093556.0000000000C98000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584653863.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585285064.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585349266.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828075611.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584870026.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585656644.0000000000C98000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584690393.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456292772.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456277440.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456389200.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585829274.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456205938.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584908649.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/
Source: regsvr32.exe, 00000007.00000003.585426852.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584653863.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585349266.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828075611.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456277440.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.585829274.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://45.63.99.23:7080/ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/
Source: unknown HTTP traffic detected: POST /ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedContent-Length: 334Host: 182.162.143.56
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.4:49700 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 00000007.00000002.827986155.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0.2.loaddll64.exe.141aeea0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.1ebd2220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.141aeea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.1bbc5810000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.1bbc5810000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.a90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.1ebd2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.828364693.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.496080462.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322442190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.321064194.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.321445782.000001BBC5810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.318945591.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.322205921.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.319306896.000001EBD2220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.496539435.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.827883820.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.320548872.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322977789.00000141AEEA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.loaddll64.exe.141aeea0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 7.2.regsvr32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 4.2.rundll32.exe.1ebd2220000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 12.2.regsvr32.exe.d20000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0.2.loaddll64.exe.141aeea0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 7.2.regsvr32.exe.ba0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 3.2.regsvr32.exe.a90000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 12.2.regsvr32.exe.d20000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 5.2.rundll32.exe.1bbc5810000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 5.2.rundll32.exe.1bbc5810000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 3.2.regsvr32.exe.a90000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 4.2.rundll32.exe.1ebd2220000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000007.00000002.828364693.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000C.00000002.496080462.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000000.00000002.322442190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000003.00000002.321064194.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000005.00000002.321445782.000001BBC5810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000004.00000002.318945591.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000003.00000002.322205921.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000004.00000002.319306896.000001EBD2220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 0000000C.00000002.496539435.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000007.00000002.827883820.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000005.00000002.320548872.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Source: 00000000.00000002.322977789.00000141AEEA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa Author: unknown
Yara signature match
Source: 0.2.loaddll64.exe.141aeea0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 4.2.rundll32.exe.1ebd2220000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 12.2.regsvr32.exe.d20000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0.2.loaddll64.exe.141aeea0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 7.2.regsvr32.exe.ba0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 3.2.regsvr32.exe.a90000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 12.2.regsvr32.exe.d20000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 5.2.rundll32.exe.1bbc5810000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 5.2.rundll32.exe.1bbc5810000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 3.2.regsvr32.exe.a90000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 4.2.rundll32.exe.1ebd2220000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000007.00000002.828364693.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000C.00000002.496080462.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000000.00000002.322442190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000003.00000002.321064194.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000005.00000002.321445782.000001BBC5810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000004.00000002.318945591.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000003.00000002.322205921.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000004.00000002.319306896.000001EBD2220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 0000000C.00000002.496539435.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000007.00000002.827883820.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000005.00000002.320548872.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Source: 00000000.00000002.322977789.00000141AEEA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Emotet_db7d33fa reference_sample = 08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc, os = windows, severity = x86, creation_date = 2022-05-09, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd, id = db7d33fa-e50c-4c59-ab92-edb74aac87c9, last_modified = 2022-06-09
Deletes files inside the Windows folder
Source: C:\Windows\System32\regsvr32.exe File deleted: C:\Windows\System32\UgFJoEzLBQVtMeg\qohQcmrlRynEDAUP.dll:Zone.Identifier Jump to behavior
Creates files inside the system directory
Source: C:\Windows\System32\loaddll64.exe File created: C:\Windows\system32\OGxcy\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C314574 0_2_00007FF88C314574
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C305D68 0_2_00007FF88C305D68
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C3115B0 0_2_00007FF88C3115B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C30D720 0_2_00007FF88C30D720
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C31C7C0 0_2_00007FF88C31C7C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C30EFA4 0_2_00007FF88C30EFA4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C31C0E8 0_2_00007FF88C31C0E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C31D118 0_2_00007FF88C31D118
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C3119D4 0_2_00007FF88C3119D4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C30EAB8 0_2_00007FF88C30EAB8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C30732C 0_2_00007FF88C30732C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C31DBCC 0_2_00007FF88C31DBCC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C31C420 0_2_00007FF88C31C420
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C313CE8 0_2_00007FF88C313CE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180001864 0_2_0000000180001864
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180012108 0_2_0000000180012108
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180027AE4 0_2_0000000180027AE4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000EB3C 0_2_000000018000EB3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000FBB4 0_2_000000018000FBB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180008470 0_2_0000000180008470
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800274F4 0_2_00000001800274F4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180007F20 0_2_0000000180007F20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019F38 0_2_0000000180019F38
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180001FE8 0_2_0000000180001FE8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800197F8 0_2_00000001800197F8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003800 0_2_0000000180003800
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180007014 0_2_0000000180007014
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180015020 0_2_0000000180015020
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000E850 0_2_000000018000E850
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000B888 0_2_000000018000B888
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180021894 0_2_0000000180021894
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180021094 0_2_0000000180021094
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026098 0_2_0000000180026098
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800180C8 0_2_00000001800180C8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800278D8 0_2_00000001800278D8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001E8E4 0_2_000000018001E8E4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800258E8 0_2_00000001800258E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800138F0 0_2_00000001800138F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C108 0_2_000000018001C108
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180015120 0_2_0000000180015120
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180007130 0_2_0000000180007130
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002C144 0_2_000000018002C144
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000795C 0_2_000000018000795C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000E97C 0_2_000000018000E97C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003990 0_2_0000000180003990
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800099A0 0_2_00000001800099A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800299A4 0_2_00000001800299A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000B9B4 0_2_000000018000B9B4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800131C8 0_2_00000001800131C8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000D1CC 0_2_000000018000D1CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800029CC 0_2_00000001800029CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800191E0 0_2_00000001800191E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A9F0 0_2_000000018001A9F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000320C 0_2_000000018000320C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180011A19 0_2_0000000180011A19
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BA34 0_2_000000018001BA34
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002BA3C 0_2_000000018002BA3C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180015240 0_2_0000000180015240
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017A40 0_2_0000000180017A40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000FA60 0_2_000000018000FA60
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A27C 0_2_000000018001A27C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025280 0_2_0000000180025280
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002228C 0_2_000000018002228C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001428C 0_2_000000018001428C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800072A4 0_2_00000001800072A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000CAB4 0_2_000000018000CAB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000BAD0 0_2_000000018000BAD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025B0C 0_2_0000000180025B0C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180021B10 0_2_0000000180021B10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003310 0_2_0000000180003310
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000E310 0_2_000000018000E310
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180010330 0_2_0000000180010330
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000C334 0_2_000000018000C334
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180015344 0_2_0000000180015344
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180006B54 0_2_0000000180006B54
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180013B6C 0_2_0000000180013B6C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001337C 0_2_000000018001337C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180009B84 0_2_0000000180009B84
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F388 0_2_000000018001F388
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019B88 0_2_0000000180019B88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001238C 0_2_000000018001238C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180023B90 0_2_0000000180023B90
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BB98 0_2_000000018001BB98
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002B39C 0_2_000000018002B39C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000B3A4 0_2_000000018000B3A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180010BAE 0_2_0000000180010BAE
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800293B4 0_2_00000001800293B4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000BBD4 0_2_000000018000BBD4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000ABDC 0_2_000000018000ABDC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180012BFC 0_2_0000000180012BFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001EBFC 0_2_000000018001EBFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180008BFC 0_2_0000000180008BFC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002A43C 0_2_000000018002A43C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180002C5C 0_2_0000000180002C5C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180013468 0_2_0000000180013468
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A470 0_2_000000018001A470
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180016C70 0_2_0000000180016C70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180014C80 0_2_0000000180014C80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180011C90 0_2_0000000180011C90
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180005498 0_2_0000000180005498
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180017CB0 0_2_0000000180017CB0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025CB8 0_2_0000000180025CB8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000CCB8 0_2_000000018000CCB8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800094BC 0_2_00000001800094BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B4CC 0_2_000000018001B4CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003CD8 0_2_0000000180003CD8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180002504 0_2_0000000180002504
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000E50C 0_2_000000018000E50C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180014514 0_2_0000000180014514
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180026518 0_2_0000000180026518
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180015524 0_2_0000000180015524
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180008D40 0_2_0000000180008D40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180001560 0_2_0000000180001560
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001C57C 0_2_000000018001C57C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180013DBC 0_2_0000000180013DBC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001FDC0 0_2_000000018001FDC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000B5CC 0_2_000000018000B5CC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800245D0 0_2_00000001800245D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180014DD0 0_2_0000000180014DD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000FDE4 0_2_000000018000FDE4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800055F4 0_2_00000001800055F4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180019E08 0_2_0000000180019E08
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001F624 0_2_000000018001F624
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003E2C 0_2_0000000180003E2C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180013634 0_2_0000000180013634
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180007658 0_2_0000000180007658
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000C65C 0_2_000000018000C65C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180025668 0_2_0000000180025668
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180006668 0_2_0000000180006668
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180008E68 0_2_0000000180008E68
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001B670 0_2_000000018001B670
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001BE70 0_2_000000018001BE70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000A678 0_2_000000018000A678
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180005684 0_2_0000000180005684
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000CE88 0_2_000000018000CE88
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180021E8C 0_2_0000000180021E8C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180018698 0_2_0000000180018698
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180023E9C 0_2_0000000180023E9C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800016A0 0_2_00000001800016A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000D6A4 0_2_000000018000D6A4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018002B6AC 0_2_000000018002B6AC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800026B0 0_2_00000001800026B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001EEE0 0_2_000000018001EEE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180027F1C 0_2_0000000180027F1C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001FF28 0_2_000000018001FF28
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180011F30 0_2_0000000180011F30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180003F54 0_2_0000000180003F54
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180029F58 0_2_0000000180029F58
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018001A764 0_2_000000018001A764
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180024788 0_2_0000000180024788
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000C788 0_2_000000018000C788
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800167C4 0_2_00000001800167C4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000AFD4 0_2_000000018000AFD4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800137DC 0_2_00000001800137DC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000141AEED0000 0_2_00000141AEED0000
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00970000 3_2_00970000
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180001864 3_2_0000000180001864
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008470 3_2_0000000180008470
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800274F4 3_2_00000001800274F4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012108 3_2_0000000180012108
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180027AE4 3_2_0000000180027AE4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180007F20 3_2_0000000180007F20
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180019F38 3_2_0000000180019F38
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000EB3C 3_2_000000018000EB3C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000FBB4 3_2_000000018000FBB4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180001FE8 3_2_0000000180001FE8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800197F8 3_2_00000001800197F8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012BFC 3_2_0000000180012BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001EBFC 3_2_000000018001EBFC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008BFC 3_2_0000000180008BFC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180003800 3_2_0000000180003800
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180007014 3_2_0000000180007014
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015020 3_2_0000000180015020
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002A43C 3_2_000000018002A43C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E850 3_2_000000018000E850
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180002C5C 3_2_0000000180002C5C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013468 3_2_0000000180013468
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A470 3_2_000000018001A470
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180016C70 3_2_0000000180016C70
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180014C80 3_2_0000000180014C80
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000B888 3_2_000000018000B888
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180011C90 3_2_0000000180011C90
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021894 3_2_0000000180021894
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021094 3_2_0000000180021094
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180026098 3_2_0000000180026098
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180005498 3_2_0000000180005498
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180017CB0 3_2_0000000180017CB0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180025CB8 3_2_0000000180025CB8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000CCB8 3_2_000000018000CCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800094BC 3_2_00000001800094BC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800180C8 3_2_00000001800180C8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001B4CC 3_2_000000018001B4CC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800278D8 3_2_00000001800278D8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180003CD8 3_2_0000000180003CD8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001E8E4 3_2_000000018001E8E4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800258E8 3_2_00000001800258E8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800138F0 3_2_00000001800138F0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180002504 3_2_0000000180002504
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001C108 3_2_000000018001C108
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E50C 3_2_000000018000E50C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180014514 3_2_0000000180014514
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180026518 3_2_0000000180026518
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015120 3_2_0000000180015120
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015524 3_2_0000000180015524
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180007130 3_2_0000000180007130
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008D40 3_2_0000000180008D40
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002C144 3_2_000000018002C144
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000795C 3_2_000000018000795C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180001560 3_2_0000000180001560
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001C57C 3_2_000000018001C57C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E97C 3_2_000000018000E97C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180003990 3_2_0000000180003990
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800099A0 3_2_00000001800099A0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800299A4 3_2_00000001800299A4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000B9B4 3_2_000000018000B9B4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013DBC 3_2_0000000180013DBC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001FDC0 3_2_000000018001FDC0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800131C8 3_2_00000001800131C8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000D1CC 3_2_000000018000D1CC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800029CC 3_2_00000001800029CC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000B5CC 3_2_000000018000B5CC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800245D0 3_2_00000001800245D0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180014DD0 3_2_0000000180014DD0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800191E0 3_2_00000001800191E0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000FDE4 3_2_000000018000FDE4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A9F0 3_2_000000018001A9F0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800055F4 3_2_00000001800055F4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180019E08 3_2_0000000180019E08
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000320C 3_2_000000018000320C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180011A19 3_2_0000000180011A19
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001F624 3_2_000000018001F624
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180003E2C 3_2_0000000180003E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013634 3_2_0000000180013634
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001BA34 3_2_000000018001BA34
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002BA3C 3_2_000000018002BA3C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015240 3_2_0000000180015240
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180017A40 3_2_0000000180017A40
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180007658 3_2_0000000180007658
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000C65C 3_2_000000018000C65C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000FA60 3_2_000000018000FA60
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180025668 3_2_0000000180025668
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180006668 3_2_0000000180006668
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008E68 3_2_0000000180008E68
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001BE70 3_2_000000018001BE70
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001B670 3_2_000000018001B670
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000A678 3_2_000000018000A678
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A27C 3_2_000000018001A27C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180025280 3_2_0000000180025280
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180005684 3_2_0000000180005684
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000CE88 3_2_000000018000CE88
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021E8C 3_2_0000000180021E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002228C 3_2_000000018002228C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001428C 3_2_000000018001428C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180018698 3_2_0000000180018698
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180023E9C 3_2_0000000180023E9C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800016A0 3_2_00000001800016A0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800072A4 3_2_00000001800072A4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000D6A4 3_2_000000018000D6A4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002B6AC 3_2_000000018002B6AC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800026B0 3_2_00000001800026B0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000CAB4 3_2_000000018000CAB4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000BAD0 3_2_000000018000BAD0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001EEE0 3_2_000000018001EEE0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180025B0C 3_2_0000000180025B0C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021B10 3_2_0000000180021B10
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E310 3_2_000000018000E310
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180003310 3_2_0000000180003310
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180027F1C 3_2_0000000180027F1C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001FF28 3_2_000000018001FF28
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180011F30 3_2_0000000180011F30
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180010330 3_2_0000000180010330
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000C334 3_2_000000018000C334
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015344 3_2_0000000180015344
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180003F54 3_2_0000000180003F54
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180006B54 3_2_0000000180006B54
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180029F58 3_2_0000000180029F58
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A764 3_2_000000018001A764
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013B6C 3_2_0000000180013B6C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001337C 3_2_000000018001337C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180009B84 3_2_0000000180009B84
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180024788 3_2_0000000180024788
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001F388 3_2_000000018001F388
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180019B88 3_2_0000000180019B88
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000C788 3_2_000000018000C788
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001238C 3_2_000000018001238C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180023B90 3_2_0000000180023B90
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001BB98 3_2_000000018001BB98
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002B39C 3_2_000000018002B39C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000B3A4 3_2_000000018000B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180010BAE 3_2_0000000180010BAE
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800293B4 3_2_00000001800293B4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800167C4 3_2_00000001800167C4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000AFD4 3_2_000000018000AFD4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000BBD4 3_2_000000018000BBD4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800137DC 3_2_00000001800137DC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000ABDC 3_2_000000018000ABDC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180001864 4_2_0000000180001864
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180008470 4_2_0000000180008470
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800274F4 4_2_00000001800274F4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180012108 4_2_0000000180012108
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180027AE4 4_2_0000000180027AE4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180007F20 4_2_0000000180007F20
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180019F38 4_2_0000000180019F38
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000EB3C 4_2_000000018000EB3C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000FBB4 4_2_000000018000FBB4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180001FE8 4_2_0000000180001FE8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800197F8 4_2_00000001800197F8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180012BFC 4_2_0000000180012BFC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001EBFC 4_2_000000018001EBFC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180008BFC 4_2_0000000180008BFC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180003800 4_2_0000000180003800
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180007014 4_2_0000000180007014
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180015020 4_2_0000000180015020
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018002A43C 4_2_000000018002A43C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000E850 4_2_000000018000E850
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180002C5C 4_2_0000000180002C5C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180013468 4_2_0000000180013468
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001A470 4_2_000000018001A470
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180016C70 4_2_0000000180016C70
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180014C80 4_2_0000000180014C80
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000B888 4_2_000000018000B888
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180011C90 4_2_0000000180011C90
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180021894 4_2_0000000180021894
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180021094 4_2_0000000180021094
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180026098 4_2_0000000180026098
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180005498 4_2_0000000180005498
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180017CB0 4_2_0000000180017CB0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180025CB8 4_2_0000000180025CB8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000CCB8 4_2_000000018000CCB8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800094BC 4_2_00000001800094BC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800180C8 4_2_00000001800180C8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001B4CC 4_2_000000018001B4CC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800278D8 4_2_00000001800278D8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180003CD8 4_2_0000000180003CD8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001E8E4 4_2_000000018001E8E4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800258E8 4_2_00000001800258E8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800138F0 4_2_00000001800138F0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180002504 4_2_0000000180002504
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001C108 4_2_000000018001C108
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000E50C 4_2_000000018000E50C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180014514 4_2_0000000180014514
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180026518 4_2_0000000180026518
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180015120 4_2_0000000180015120
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180015524 4_2_0000000180015524
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180007130 4_2_0000000180007130
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180008D40 4_2_0000000180008D40
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018002C144 4_2_000000018002C144
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000795C 4_2_000000018000795C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180001560 4_2_0000000180001560
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001C57C 4_2_000000018001C57C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000E97C 4_2_000000018000E97C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180003990 4_2_0000000180003990
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800099A0 4_2_00000001800099A0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800299A4 4_2_00000001800299A4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000B9B4 4_2_000000018000B9B4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180013DBC 4_2_0000000180013DBC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001FDC0 4_2_000000018001FDC0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800131C8 4_2_00000001800131C8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000D1CC 4_2_000000018000D1CC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800029CC 4_2_00000001800029CC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000B5CC 4_2_000000018000B5CC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800245D0 4_2_00000001800245D0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180014DD0 4_2_0000000180014DD0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800191E0 4_2_00000001800191E0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000FDE4 4_2_000000018000FDE4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001A9F0 4_2_000000018001A9F0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800055F4 4_2_00000001800055F4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180019E08 4_2_0000000180019E08
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000320C 4_2_000000018000320C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180011A19 4_2_0000000180011A19
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001F624 4_2_000000018001F624
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180003E2C 4_2_0000000180003E2C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180013634 4_2_0000000180013634
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001BA34 4_2_000000018001BA34
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018002BA3C 4_2_000000018002BA3C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180015240 4_2_0000000180015240
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180017A40 4_2_0000000180017A40
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180007658 4_2_0000000180007658
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000C65C 4_2_000000018000C65C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000FA60 4_2_000000018000FA60
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180025668 4_2_0000000180025668
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180006668 4_2_0000000180006668
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180008E68 4_2_0000000180008E68
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001BE70 4_2_000000018001BE70
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001B670 4_2_000000018001B670
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000A678 4_2_000000018000A678
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001A27C 4_2_000000018001A27C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180025280 4_2_0000000180025280
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180005684 4_2_0000000180005684
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000CE88 4_2_000000018000CE88
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180021E8C 4_2_0000000180021E8C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018002228C 4_2_000000018002228C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001428C 4_2_000000018001428C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180018698 4_2_0000000180018698
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180023E9C 4_2_0000000180023E9C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800016A0 4_2_00000001800016A0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800072A4 4_2_00000001800072A4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000D6A4 4_2_000000018000D6A4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018002B6AC 4_2_000000018002B6AC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800026B0 4_2_00000001800026B0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000CAB4 4_2_000000018000CAB4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000BAD0 4_2_000000018000BAD0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001EEE0 4_2_000000018001EEE0
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180025B0C 4_2_0000000180025B0C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180021B10 4_2_0000000180021B10
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000E310 4_2_000000018000E310
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180003310 4_2_0000000180003310
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180027F1C 4_2_0000000180027F1C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001FF28 4_2_000000018001FF28
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180011F30 4_2_0000000180011F30
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180010330 4_2_0000000180010330
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000C334 4_2_000000018000C334
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180015344 4_2_0000000180015344
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180003F54 4_2_0000000180003F54
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180006B54 4_2_0000000180006B54
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180029F58 4_2_0000000180029F58
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001A764 4_2_000000018001A764
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180013B6C 4_2_0000000180013B6C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001337C 4_2_000000018001337C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180009B84 4_2_0000000180009B84
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180024788 4_2_0000000180024788
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001F388 4_2_000000018001F388
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180019B88 4_2_0000000180019B88
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000C788 4_2_000000018000C788
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001238C 4_2_000000018001238C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180023B90 4_2_0000000180023B90
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018001BB98 4_2_000000018001BB98
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018002B39C 4_2_000000018002B39C
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000B3A4 4_2_000000018000B3A4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180010BAE 4_2_0000000180010BAE
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800293B4 4_2_00000001800293B4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800167C4 4_2_00000001800167C4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000AFD4 4_2_000000018000AFD4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000BBD4 4_2_000000018000BBD4
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800137DC 4_2_00000001800137DC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000ABDC 4_2_000000018000ABDC
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000001EBD2250000 4_2_000001EBD2250000
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180001864 5_2_0000000180001864
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180008470 5_2_0000000180008470
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800274F4 5_2_00000001800274F4
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180012108 5_2_0000000180012108
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180027AE4 5_2_0000000180027AE4
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180007F20 5_2_0000000180007F20
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180019F38 5_2_0000000180019F38
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000EB3C 5_2_000000018000EB3C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000FBB4 5_2_000000018000FBB4
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180001FE8 5_2_0000000180001FE8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800197F8 5_2_00000001800197F8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180012BFC 5_2_0000000180012BFC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001EBFC 5_2_000000018001EBFC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180008BFC 5_2_0000000180008BFC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180003800 5_2_0000000180003800
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180007014 5_2_0000000180007014
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180015020 5_2_0000000180015020
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018002A43C 5_2_000000018002A43C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000E850 5_2_000000018000E850
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180002C5C 5_2_0000000180002C5C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180013468 5_2_0000000180013468
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001A470 5_2_000000018001A470
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180016C70 5_2_0000000180016C70
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180014C80 5_2_0000000180014C80
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000B888 5_2_000000018000B888
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180011C90 5_2_0000000180011C90
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180021894 5_2_0000000180021894
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180021094 5_2_0000000180021094
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180026098 5_2_0000000180026098
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180005498 5_2_0000000180005498
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180017CB0 5_2_0000000180017CB0
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180025CB8 5_2_0000000180025CB8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000CCB8 5_2_000000018000CCB8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800094BC 5_2_00000001800094BC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800180C8 5_2_00000001800180C8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001B4CC 5_2_000000018001B4CC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800278D8 5_2_00000001800278D8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180003CD8 5_2_0000000180003CD8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001E8E4 5_2_000000018001E8E4
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800258E8 5_2_00000001800258E8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800138F0 5_2_00000001800138F0
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180002504 5_2_0000000180002504
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001C108 5_2_000000018001C108
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000E50C 5_2_000000018000E50C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180014514 5_2_0000000180014514
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180026518 5_2_0000000180026518
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180015120 5_2_0000000180015120
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180015524 5_2_0000000180015524
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180007130 5_2_0000000180007130
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180008D40 5_2_0000000180008D40
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018002C144 5_2_000000018002C144
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000795C 5_2_000000018000795C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180001560 5_2_0000000180001560
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001C57C 5_2_000000018001C57C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000E97C 5_2_000000018000E97C
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180003990 5_2_0000000180003990
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800099A0 5_2_00000001800099A0
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800299A4 5_2_00000001800299A4
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000B9B4 5_2_000000018000B9B4
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180013DBC 5_2_0000000180013DBC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018001FDC0 5_2_000000018001FDC0
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800131C8 5_2_00000001800131C8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_000000018000D1CC 5_2_000000018000D1CC
Tries to load missing DLLs
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: yoyrJ.dll ReversingLabs: Detection: 88%
Source: yoyrJ.dll Metadefender: Detection: 47%
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\yoyrJ.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\yoyrJ.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\yoyrJ.dll
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yoyrJ.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yoyrJ.dll,DllRegisterServer
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RPhOZPFULSaJ\nMwLrZYwR.dll"
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UgFJoEzLBQVtMeg\qohQcmrlRynEDAUP.dll"
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YbSMYJyTdzumryV\WWgeEzfCEnB.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OGxcy\dYkxHTuA.dll"
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\ArkmTuxCaKyXkTDZ\fBEZnVEOT.dll"
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\yoyrJ.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\yoyrJ.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yoyrJ.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OGxcy\dYkxHTuA.dll" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yoyrJ.dll",#1 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UgFJoEzLBQVtMeg\qohQcmrlRynEDAUP.dll" Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RPhOZPFULSaJ\nMwLrZYwR.dll" Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YbSMYJyTdzumryV\WWgeEzfCEnB.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\ArkmTuxCaKyXkTDZ\fBEZnVEOT.dll" Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File created: C:\Users\user\AppData\Local\ArkmTuxCaKyXkTDZ\ Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winDLL@21/2@0/54
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C3038E8 CreateWindowExW,RegisterTouchWindow,MessageBoxW,CoCreateInstance,ShowWindow,UpdateWindow, 0_2_00007FF88C3038E8
Source: C:\Windows\System32\loaddll64.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800274F4 FindCloseChangeNotification,Process32FirstW,CreateToolhelp32Snapshot, 0_2_00000001800274F4
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yoyrJ.dll",#1
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3096:120:WilError_01
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\wbem\WMIADAP.exe Automated click: OK
Source: C:\Windows\System32\wbem\WMIADAP.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: yoyrJ.dll Static PE information: Image base 0x180000000 > 0x60000000
Source: yoyrJ.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180005098 push ebp; ret 0_2_0000000180005099
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800118AD push esp; retn 0000h 0_2_00000001800118B5
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800170C8 push eax; retf 0_2_00000001800170C9
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800170DD push ecx; iretd 0_2_00000001800170E2
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000018000512B push ebp; retf 0_2_000000018000512F
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180004938 push eax; ret 0_2_000000018000493B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800171F0 push eax; retf 0_2_00000001800171F1
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000000180010F42 push 8B48E1F7h; retf 0_2_0000000180010F51
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00000001800117D6 pushad ; ret 0_2_00000001800117D8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180005098 push ebp; ret 3_2_0000000180005099
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800118AD push esp; retn 0000h 3_2_00000001800118B5
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800170C8 push eax; retf 3_2_00000001800170C9
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800170DD push ecx; iretd 3_2_00000001800170E2
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000512B push ebp; retf 3_2_000000018000512F
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180004938 push eax; ret 3_2_000000018000493B
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800171F0 push eax; retf 3_2_00000001800171F1
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180010F42 push 8B48E1F7h; retf 3_2_0000000180010F51
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800117D6 pushad ; ret 3_2_00000001800117D8
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180005098 push ebp; ret 4_2_0000000180005099
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800118AD push esp; retn 0000h 4_2_00000001800118B5
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800170C8 push eax; retf 4_2_00000001800170C9
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800170DD push ecx; iretd 4_2_00000001800170E2
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000018000512B push ebp; retf 4_2_000000018000512F
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180004938 push eax; ret 4_2_000000018000493B
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800171F0 push eax; retf 4_2_00000001800171F1
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_0000000180010F42 push 8B48E1F7h; retf 4_2_0000000180010F51
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_00000001800117D6 pushad ; ret 4_2_00000001800117D8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_0000000180005098 push ebp; ret 5_2_0000000180005099
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800118AD push esp; retn 0000h 5_2_00000001800118B5
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800170C8 push eax; retf 5_2_00000001800170C9
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000001800170DD push ecx; iretd 5_2_00000001800170E2
PE file contains sections with non-standard names
Source: yoyrJ.dll Static PE information: section name: text
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C312ED4 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00007FF88C312ED4
PE file contains an invalid checksum
Source: yoyrJ.dll Static PE information: real checksum: 0x6e4a7 should be: 0x72327
Registers a DLL
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\yoyrJ.dll
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe PE file moved: C:\Windows\System32\UgFJoEzLBQVtMeg\qohQcmrlRynEDAUP.dll Jump to behavior

Boot Survival
barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run qohQcmrlRynEDAUP.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run qohQcmrlRynEDAUP.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run qohQcmrlRynEDAUP.dll Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\loaddll64.exe File opened: C:\Windows\system32\OGxcy\dYkxHTuA.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\UgFJoEzLBQVtMeg\qohQcmrlRynEDAUP.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\system32\RPhOZPFULSaJ\nMwLrZYwR.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\system32\YbSMYJyTdzumryV\WWgeEzfCEnB.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Users\user\AppData\Local\ArkmTuxCaKyXkTDZ\fBEZnVEOT.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\regsvr32.exe TID: 5396 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 1664 Thread sleep count: 2698 > 30 Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 1664 Thread sleep count: 2698 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 2698 Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 2698 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E0D4 FindFirstFileW,FindNextFileW,FindClose, 7_2_000000018001E0D4
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: regsvr32.exe, 00000007.00000003.585862169.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828134623.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584870026.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584622965.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828052946.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456389200.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456205938.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456259811.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584908649.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000007.00000003.585862169.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.828134623.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584870026.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456389200.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.456205938.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.584908649.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWf
Source: loaddll64.exe, 00000000.00000003.320147566.00000141AEF45000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\C
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C304980 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF88C304980
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C312ED4 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00007FF88C312ED4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C304980 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF88C304980
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C3091F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF88C3091F4

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 45.63.99.23 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.255.211.88 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yoyrJ.dll",#1 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\System32\loaddll64.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW, 0_2_00007FF88C317D58
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesA, 0_2_00007FF88C317EC8
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesA, 0_2_00007FF88C317E88
Source: C:\Windows\System32\loaddll64.exe Code function: EnumSystemLocalesA, 0_2_00007FF88C317F60
Source: C:\Windows\System32\loaddll64.exe Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s, 0_2_00007FF88C317FCC
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_00007FF88C3177EC
Source: C:\Windows\System32\loaddll64.exe Code function: _getptd,GetLocaleInfoA, 0_2_00007FF88C317910
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW, 0_2_00007FF88C3179F8
Source: C:\Windows\System32\loaddll64.exe Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW, 0_2_00007FF88C317A88
Source: C:\Windows\System32\loaddll64.exe Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW, 0_2_00007FF88C312BF4
Source: C:\Windows\System32\loaddll64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,free, 0_2_00007FF88C318470
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C308C48 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_00007FF88C308C48
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FF88C3075D0 HeapCreate,GetVersion,HeapSetInformation, 0_2_00007FF88C3075D0

Stealing of Sensitive Information
barindex
Yara detected Emotet
Source: Yara match File source: 00000007.00000002.827986155.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0.2.loaddll64.exe.141aeea0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.1ebd2220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.141aeea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.1bbc5810000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.1bbc5810000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.a90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.1ebd2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.828364693.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.496080462.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322442190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.321064194.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.321445782.000001BBC5810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.318945591.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.322205921.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.319306896.000001EBD2220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.496539435.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.827883820.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.320548872.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322977789.00000141AEEA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 750476 Sample: yoyrJ.dll Startdate: 21/11/2022 Architecture: WINDOWS Score: 100 35 129.232.188.93 xneeloZA South Africa 2->35 37 45.235.8.30 WIKINETTELECOMUNICACOESBR Brazil 2->37 39 49 other IPs or domains 2->39 47 Snort IDS alert for network traffic 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 3 other signatures 2->53 9 loaddll64.exe 3 2->9         started        signatures3 process4 signatures5 61 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->61 12 regsvr32.exe 2 9->12         started        15 cmd.exe 1 9->15         started        17 rundll32.exe 2 9->17         started        19 3 other processes 9->19 process6 signatures7 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->63 21 regsvr32.exe 1 12->21         started        25 rundll32.exe 2 15->25         started        27 regsvr32.exe 17->27         started        29 regsvr32.exe 19->29         started        process8 dnsIp9 41 173.255.211.88, 443, 49695, 49696 LINODE-APLinodeLLCUS United States 21->41 43 182.162.143.56, 443, 49700 LGDACOMLGDACOMCorporationKR Korea Republic of 21->43 45 45.63.99.23, 7080 AS-CHOOPAUS United States 21->45 55 System process connects to network (likely due to code injection or exploit) 21->55 57 Creates an autostart registry key pointing to binary in C:\Windows 21->57 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->59 31 WMIADAP.exe 4 25->31         started        33 regsvr32.exe 25->33         started        signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.232.117.186
 unknown Australia
56038 RACKCORP-APRackCorpAU true
103.132.242.26
 unknown India
45117 INPL-IN-APIshansNetworkIN true
104.168.155.143
 unknown United States
54290 HOSTWINDSUS true
79.137.35.198
 unknown France
16276 OVHFR true
45.118.115.99
 unknown Indonesia
131717 IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID true
172.104.251.154
 unknown United States
63949 LINODE-APLinodeLLCUS true
115.68.227.76
 unknown Korea Republic of
38700 SMILESERV-AS-KRSMILESERVKR true
163.44.196.120
 unknown Singapore
135161 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG true
206.189.28.199
 unknown United States
14061 DIGITALOCEAN-ASNUS true
45.63.99.23
 unknown United States
20473 AS-CHOOPAUS true
107.170.39.149
 unknown United States
14061 DIGITALOCEAN-ASNUS true
197.242.150.244
 unknown South Africa
37611 AfrihostZA true
185.4.135.165
 unknown Greece
199246 TOPHOSTGR true
183.111.227.137
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR true
45.176.232.124
 unknown Colombia
267869 CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC true
139.59.56.73
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
169.57.156.166
 unknown United States
36351 SOFTLAYERUS true
164.68.99.3
 unknown Germany
51167 CONTABODE true
139.59.126.41
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
167.172.253.162
 unknown United States
14061 DIGITALOCEAN-ASNUS true
147.139.166.154
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true
202.129.205.3
 unknown Thailand
45328 NIPA-AS-THNIPATECHNOLOGYCOLTDTH true
167.172.199.165
 unknown United States
14061 DIGITALOCEAN-ASNUS true
153.92.5.27
 unknown Germany
47583 AS-HOSTINGERLT true
159.65.140.115
 unknown United States
14061 DIGITALOCEAN-ASNUS true
159.65.88.10
 unknown United States
14061 DIGITALOCEAN-ASNUS true
172.105.226.75
 unknown United States
63949 LINODE-APLinodeLLCUS true
164.90.222.65
 unknown United States
14061 DIGITALOCEAN-ASNUS true
213.239.212.5
 unknown Germany
24940 HETZNER-ASDE true
5.135.159.50
 unknown France
16276 OVHFR true
173.255.211.88
 unknown United States
63949 LINODE-APLinodeLLCUS true
212.24.98.99
 unknown Lithuania
62282 RACKRAYUABRakrejusLT true
186.194.240.217
 unknown Brazil
262733 NetceteraTelecomunicacoesLtdaBR true
91.187.140.35
 unknown Serbia
13092 UB-ASRS true
119.59.103.152
 unknown Thailand
56067 METRABYTE-TH453LadplacoutJorakhaebuaTH true
159.89.202.34
 unknown United States
14061 DIGITALOCEAN-ASNUS true
201.94.166.162
 unknown Brazil
28573 CLAROSABR true
160.16.142.56
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP true
103.75.201.2
 unknown Thailand
133496 CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH true
91.207.28.33
 unknown Kyrgyzstan
39819 PROHOSTKG true
103.43.75.120
 unknown Japan 20473 AS-CHOOPAUS true
188.44.20.25
 unknown Macedonia
57374 GIV-ASMK true
45.235.8.30
 unknown Brazil
267405 WIKINETTELECOMUNICACOESBR true
153.126.146.25
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP true
72.15.201.15
 unknown United States
13649 ASN-VINSUS true
82.223.21.224
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE true
173.212.193.249
 unknown Germany
51167 CONTABODE true
95.217.221.146
 unknown Germany
24940 HETZNER-ASDE true
149.56.131.28
 unknown Canada
16276 OVHFR true
209.97.163.214
 unknown United States
14061 DIGITALOCEAN-ASNUS true
182.162.143.56
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
1.234.2.232
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
129.232.188.93
 unknown South Africa
37153 xneeloZA true
94.23.45.86
 unknown France
16276 OVHFR true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://182.162.143.56/ltqyvaphgamn/iuduszibmmiode/zgmecigm/lvlmwwim/ true
  • Avira URL Cloud: malware
 unknown