Edit tour

Windows Analysis Report
042_qbot.dll.dll

Overview

General Information

Sample Name:	042_qbot.dll.dll (renamed file extension from dat to dll, renamed because original name is a hash value)
Original Sample Name:	042_qbot.dll.dat
Analysis ID:	882935
MD5:	8c18224b2fcb618bb4305a8687b3bb22
SHA1:	c0a9a8cb468d0f9b185fa1112683612c01c60673
SHA256:	d93d05a84c4d9579accd5dc839ee9f8f7e7f54c623e37175a59146664530dc3d
Infos:

Detection

Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Sample uses string decryption to hide its real strings

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Found evasive API chain (date check)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Tries to load missing DLLs

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6868 cmdline: loaddll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll" MD5: 3B4636AE519868037940CA5C4272091B)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3680 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 1108 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5804 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 664 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 5436 cmdline: rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_block_row MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5812 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 676 cmdline: rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_sample_rows MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4144 cmdline: rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,ldiv_round_up MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7048 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_block_row MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7076 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_sample_rows MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7132 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",ldiv_round_up MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7140 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 7220 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

rundll32.exe (PID: 2240 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lround_up MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5796 cmdline: rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lpeg_write_tables MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7076 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 660 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "BB30", "Campaign": "1685686808", "Version": "404.1346", "C2 list": ["86.173.2.12:2222", "92.9.45.20:2222", "100.4.163.158:2222", "213.64.33.92:2222", "75.98.154.19:443", "78.192.109.105:2222", "88.126.94.4:50000", "70.28.50.223:2083", "92.154.17.149:2222", "24.234.220.88:993", "87.252.106.39:995", "174.4.89.3:443", "12.172.173.82:20", "90.29.86.138:2222", "70.160.67.203:443", "223.166.13.95:995", "184.181.75.148:443", "95.45.50.93:2222", "201.143.215.69:443", "64.121.161.102:443", "2.82.8.80:443", "188.28.19.84:443", "81.101.185.146:443", "79.77.142.22:2222", "84.215.202.8:443", "183.87.163.165:443", "74.12.147.139:2078", "74.12.147.139:2222", "74.12.147.139:2222", "74.12.147.139:2083", "70.28.50.223:2078", "94.204.202.106:443", "87.221.153.182:2222", "70.28.50.223:2087", "24.234.220.88:990", "2.49.63.160:2222", "72.205.104.134:443", "199.27.66.213:443", "83.249.198.100:2222", "90.104.151.37:2222", "116.75.63.183:443", "70.28.50.223:2078", "117.195.17.148:993", "77.126.99.230:443", "45.62.70.33:443", "24.234.220.88:465", "203.109.44.236:995", "75.109.111.89:443", "161.142.103.187:995", "77.86.98.236:443", "147.147.30.126:2222", "124.246.122.199:2222", "103.123.223.133:443", "180.151.19.13:2078", "176.142.207.63:443", "12.172.173.82:32101", "103.140.174.20:2222", "70.50.83.216:2222", "12.172.173.82:465", "38.2.18.164:443", "93.187.148.45:995", "70.64.77.115:443", "12.172.173.82:21", "70.49.205.198:2222", "27.0.48.233:443", "12.172.173.82:50001", "83.110.223.61:443", "103.141.50.43:995", "85.101.239.116:443", "103.42.86.42:995", "92.1.170.110:995", "81.229.117.95:2222", "124.122.47.148:443", "103.212.19.254:995", "103.139.242.6:443", "125.99.76.102:443", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "70.28.50.223:32100", "79.168.224.165:2222", "121.121.108.120:995", "69.160.121.6:61201", "200.84.211.255:2222", "201.244.108.183:995", "93.187.148.45:443", "85.61.165.153:2222", "184.182.66.109:443", "175.156.217.7:2222", "70.28.50.223:3389", "114.143.176.236:443", "65.95.141.84:2222", "80.6.50.34:443", "12.172.173.82:2087", "47.199.241.39:443", "66.241.183.99:443", "113.11.92.30:443", "186.75.95.6:443", "125.99.69.178:443", "109.130.247.84:2222", "96.56.197.26:2222", "70.50.1.252:2222", "91.160.70.68:32100", "67.70.120.249:2222", "209.171.160.69:995", "98.163.227.79:443", "176.133.4.230:995", "24.234.220.88:995", "45.62.75.250:443", "200.44.198.47:2222", "173.17.45.60:443", "5.192.141.228:2222", "184.63.133.131:995", "70.28.50.223:2083", "78.82.143.154:2222", "73.88.173.113:443", "181.4.225.225:443", "24.234.220.88:443", "174.58.146.57:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.393595991.00000000045F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000000F.00000002.393475523.000000000296A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.rundll32.exe.10000000.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xec55:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa87b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
15.2.rundll32.exe.10000000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
15.2.rundll32.exe.2980960.0.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xec55:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa87b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
15.2.rundll32.exe.2980960.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
15.2.rundll32.exe.2980960.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xe055:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9c7b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
15.2.rundll32.exe.2980960.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 2 - Source IP: 192.168.2.3 - Destination IP: 109.130.247.84

Timestamp:	192.168.2.3109.130.247.844971422222404302 06/07/23-01:07:51.615603
SID:	2404302
Source Port:	49714
Destination Port:	2222
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000F.00000002.393475523.000000000296A000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "BB30", "Campaign": "1685686808", "Version": "404.1346", "C2 list": ["86.173.2.12:2222", "92.9.45.20:2222", "100.4.163.158:2222", "213.64.33.92:2222", "75.98.154.19:443", "78.192.109.105:2222", "88.126.94.4:50000", "70.28.50.223:2083", "92.154.17.149:2222", "24.234.220.88:993", "87.252.106.39:995", "174.4.89.3:443", "12.172.173.82:20", "90.29.86.138:2222", "70.160.67.203:443", "223.166.13.95:995", "184.181.75.148:443", "95.45.50.93:2222", "201.143.215.69:443", "64.121.161.102:443", "2.82.8.80:443", "188.28.19.84:443", "81.101.185.146:443", "79.77.142.22:2222", "84.215.202.8:443", "183.87.163.165:443", "74.12.147.139:2078", "74.12.147.139:2222", "74.12.147.139:2222", "74.12.147.139:2083", "70.28.50.223:2078", "94.204.202.106:443", "87.221.153.182:2222", "70.28.50.223:2087", "24.234.220.88:990", "2.49.63.160:2222", "72.205.104.134:443", "199.27.66.213:443", "83.249.198.100:2222", "90.104.151.37:2222", "116.75.63.183:443", "70.28.50.223:2078", "117.195.17.148:993", "77.126.99.230:443", "45.62.70.33:443", "24.234.220.88:465", "203.109.44.236:995", "75.109.111.89:443", "161.142.103.187:995", "77.86.98.236:443", "147.147.30.126:2222", "124.246.122.199:2222", "103.123.223.133:443", "180.151.19.13:2078", "176.142.207.63:443", "12.172.173.82:32101", "103.140.174.20:2222", "70.50.83.216:2222", "12.172.173.82:465", "38.2.18.164:443", "93.187.148.45:995", "70.64.77.115:443", "12.172.173.82:21", "70.49.205.198:2222", "27.0.48.233:443", "12.172.173.82:50001", "83.110.223.61:443", "103.141.50.43:995", "85.101.239.116:443", "103.42.86.42:995", "92.1.170.110:995", "81.229.117.95:2222", "124.122.47.148:443", "103.212.19.254:995", "103.139.242.6:443", "125.99.76.102:443", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "70.28.50.223:32100", "79.168.224.165:2222", "121.121.108.120:995", "69.160.121.6:61201", "200.84.211.255:2222", "201.244.108.183:995", "93.187.148.45:443", "85.61.165.153:2222", "184.182.66.109:443", "175.156.217.7:2222", "70.28.50.223:3389", "114.143.176.236:443", "65.95.141.84:2222", "80.6.50.34:443", "12.172.173.82:2087", "47.199.241.39:443", "66.241.183.99:443", "113.11.92.30:443", "186.75.95.6:443", "125.99.69.178:443", "109.130.247.84:2222", "96.56.197.26:2222", "70.50.1.252:2222", "91.160.70.68:32100", "67.70.120.249:2222", "209.171.160.69:995", "98.163.227.79:443", "176.133.4.230:995", "24.234.220.88:995", "45.62.75.250:443", "200.44.198.47:2222", "173.17.45.60:443", "5.192.141.228:2222", "184.63.133.131:995", "70.28.50.223:2083", "78.82.143.154:2222", "73.88.173.113:443", "181.4.225.225:443", "24.234.220.88:443", "174.58.146.57:443"]}

Multi AV Scanner detection for submitted file

Source: 042_qbot.dll.dll	ReversingLabs: Detection: 58%
Source: 042_qbot.dll.dll	Virustotal: Detection: 64%			Perma Link

Sample uses string decryption to hide its real strings

Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: netstat -nao
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: runas
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ipconfig /all
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: net localgroup
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Microsoft
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELF_TEST_1
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: p%08x
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Self test FAILED!!!
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Self test OK.
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: /t5
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: whoami /all
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: cmd
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: route print
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .lnk
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: arp -a
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: net share
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: cmd.exe /c set
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Self check
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %u;%u;%u;
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ProfileImagePath
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ProgramData
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Self check ok!
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: powershell.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: qwinsta
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: net view
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Component_08
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Start screenshot
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: appidapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: c:\ProgramData
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Component_07
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: powershell.exe -encodedCommand
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: netstat -nao
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: runas
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ipconfig /all
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SystemRoot
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: cscript.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: C:\INTERNAL\__empty
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_PhysicalMemory
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ALLUSERSPROFILE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: image/jpeg
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: LocalLow
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: displayName
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: shlwapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CommandLine
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: kernel32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SubmitSamplesConsent
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: 1234567890
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wbj.go
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_DiskDrive
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: System32
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Name
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: WRSA.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: c:\\
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SpyNetReporting
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: FALSE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aswhookx.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Packages
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: application/x-shockwave-flash
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: RepUx.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Winsta0
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: avp.exe;kavtray.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: root\SecurityCenter2
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: MsMpEng.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: userenv.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: csc_ui.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: \\.\pipe\
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: pstorec.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: NTUSER.DAT
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: from
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: netapi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: gdi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: setupapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: iphlpapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CrAmTray.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_ComputerSystem
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: user32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: \sf2.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: egui.exe;ekrn.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Software\Microsoft
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %S.%06d
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: bcrypt.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wtsapi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: shell32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: TRUE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_Bios
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: c:\hiberfil.sysss
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: /
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ByteFence.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: type=0x%04X
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: snxhk_border_mywnd
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ROOT\CIMV2
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: https
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: fshoster32.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: kernelbase.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: regsvr32.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %s\system32\
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_Process
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: rundll32.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: LOCALAPPDATA
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: cmd.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: APPDATA
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: select
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: mcshield.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: advapi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ws2_32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .cfg
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_Product
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: WQL
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wininet.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: LastBootUpTime
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: urlmon.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Create
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_PnPEntity
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Initializing database...
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: winsta0\default
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .dat
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: WBJ_IGNORE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: next
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wpcap.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: image/pjpeg
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: fmon.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: vbs
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aswhooka.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SysWOW64
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: mpr.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: image/gif
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: crypt32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ntdll.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: open
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SystemRoot
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: cscript.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: C:\INTERNAL\__empty
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_PhysicalMemory
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ALLUSERSPROFILE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: image/jpeg
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: LocalLow
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: displayName
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: shlwapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CommandLine
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: kernel32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SubmitSamplesConsent
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: 1234567890
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wbj.go
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_DiskDrive
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: System32
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Name
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: WRSA.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: c:\\
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SpyNetReporting
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: FALSE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aswhookx.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Packages
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: application/x-shockwave-flash
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: RepUx.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Winsta0
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: avp.exe;kavtray.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: root\SecurityCenter2
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: MsMpEng.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: userenv.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: csc_ui.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: \\.\pipe\
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: pstorec.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: NTUSER.DAT
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: from
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: netapi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: gdi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: setupapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: iphlpapi.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CrAmTray.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_ComputerSystem
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: user32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: \sf2.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: egui.exe;ekrn.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Software\Microsoft
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %S.%06d
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: bcrypt.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wtsapi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: shell32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: TRUE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_Bios
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: c:\hiberfil.sysss
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: /
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ByteFence.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: type=0x%04X
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: snxhk_border_mywnd
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ROOT\CIMV2
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: https
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: fshoster32.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: kernelbase.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: regsvr32.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %s\system32\
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_Process
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: rundll32.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: LOCALAPPDATA
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: cmd.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: APPDATA
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: select
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: mcshield.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: advapi32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ws2_32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .cfg
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_Product
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: WQL
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wininet.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: LastBootUpTime
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: urlmon.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Create
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Win32_PnPEntity
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Initializing database...
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: winsta0\default
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: .dat
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: WBJ_IGNORE
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: next
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: wpcap.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: image/pjpeg
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: fmon.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: vbs
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: aswhooka.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: SysWOW64
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: mpr.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: image/gif
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: crypt32.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: ntdll.dll
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: open
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 15.2.rundll32.exe.2980960.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: 042_qbot.dll.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 15_2_10009E70 FindFirstFileW,FindNextFileW,

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.3:49714 -> 109.130.247.84:2222

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 86.173.2.12:2222
Source: Malware configuration extractor	IPs: 92.9.45.20:2222
Source: Malware configuration extractor	IPs: 100.4.163.158:2222
Source: Malware configuration extractor	IPs: 213.64.33.92:2222
Source: Malware configuration extractor	IPs: 75.98.154.19:443
Source: Malware configuration extractor	IPs: 78.192.109.105:2222
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 70.28.50.223:2083
Source: Malware configuration extractor	IPs: 92.154.17.149:2222
Source: Malware configuration extractor	IPs: 24.234.220.88:993
Source: Malware configuration extractor	IPs: 87.252.106.39:995
Source: Malware configuration extractor	IPs: 174.4.89.3:443
Source: Malware configuration extractor	IPs: 12.172.173.82:20
Source: Malware configuration extractor	IPs: 90.29.86.138:2222
Source: Malware configuration extractor	IPs: 70.160.67.203:443
Source: Malware configuration extractor	IPs: 223.166.13.95:995
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 201.143.215.69:443
Source: Malware configuration extractor	IPs: 64.121.161.102:443
Source: Malware configuration extractor	IPs: 2.82.8.80:443
Source: Malware configuration extractor	IPs: 188.28.19.84:443
Source: Malware configuration extractor	IPs: 81.101.185.146:443
Source: Malware configuration extractor	IPs: 79.77.142.22:2222
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 183.87.163.165:443
Source: Malware configuration extractor	IPs: 74.12.147.139:2078
Source: Malware configuration extractor	IPs: 74.12.147.139:2222
Source: Malware configuration extractor	IPs: 74.12.147.139:2222
Source: Malware configuration extractor	IPs: 74.12.147.139:2083
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 94.204.202.106:443
Source: Malware configuration extractor	IPs: 87.221.153.182:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 24.234.220.88:990
Source: Malware configuration extractor	IPs: 2.49.63.160:2222
Source: Malware configuration extractor	IPs: 72.205.104.134:443
Source: Malware configuration extractor	IPs: 199.27.66.213:443
Source: Malware configuration extractor	IPs: 83.249.198.100:2222
Source: Malware configuration extractor	IPs: 90.104.151.37:2222
Source: Malware configuration extractor	IPs: 116.75.63.183:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 117.195.17.148:993
Source: Malware configuration extractor	IPs: 77.126.99.230:443
Source: Malware configuration extractor	IPs: 45.62.70.33:443
Source: Malware configuration extractor	IPs: 24.234.220.88:465
Source: Malware configuration extractor	IPs: 203.109.44.236:995
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 77.86.98.236:443
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 124.246.122.199:2222
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 180.151.19.13:2078
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 103.140.174.20:2222
Source: Malware configuration extractor	IPs: 70.50.83.216:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 38.2.18.164:443
Source: Malware configuration extractor	IPs: 93.187.148.45:995
Source: Malware configuration extractor	IPs: 70.64.77.115:443
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 70.49.205.198:2222
Source: Malware configuration extractor	IPs: 27.0.48.233:443
Source: Malware configuration extractor	IPs: 12.172.173.82:50001
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 103.141.50.43:995
Source: Malware configuration extractor	IPs: 85.101.239.116:443
Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 92.1.170.110:995
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 103.212.19.254:995
Source: Malware configuration extractor	IPs: 103.139.242.6:443
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 12.172.173.82:22
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 121.121.108.120:995
Source: Malware configuration extractor	IPs: 69.160.121.6:61201
Source: Malware configuration extractor	IPs: 200.84.211.255:2222
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 93.187.148.45:443
Source: Malware configuration extractor	IPs: 85.61.165.153:2222
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 175.156.217.7:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 80.6.50.34:443
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 47.199.241.39:443
Source: Malware configuration extractor	IPs: 66.241.183.99:443
Source: Malware configuration extractor	IPs: 113.11.92.30:443
Source: Malware configuration extractor	IPs: 186.75.95.6:443
Source: Malware configuration extractor	IPs: 125.99.69.178:443
Source: Malware configuration extractor	IPs: 109.130.247.84:2222
Source: Malware configuration extractor	IPs: 96.56.197.26:2222
Source: Malware configuration extractor	IPs: 70.50.1.252:2222
Source: Malware configuration extractor	IPs: 91.160.70.68:32100
Source: Malware configuration extractor	IPs: 67.70.120.249:2222
Source: Malware configuration extractor	IPs: 209.171.160.69:995
Source: Malware configuration extractor	IPs: 98.163.227.79:443
Source: Malware configuration extractor	IPs: 176.133.4.230:995
Source: Malware configuration extractor	IPs: 24.234.220.88:995
Source: Malware configuration extractor	IPs: 45.62.75.250:443
Source: Malware configuration extractor	IPs: 200.44.198.47:2222
Source: Malware configuration extractor	IPs: 173.17.45.60:443
Source: Malware configuration extractor	IPs: 5.192.141.228:2222
Source: Malware configuration extractor	IPs: 184.63.133.131:995
Source: Malware configuration extractor	IPs: 70.28.50.223:2083
Source: Malware configuration extractor	IPs: 78.82.143.154:2222
Source: Malware configuration extractor	IPs: 73.88.173.113:443
Source: Malware configuration extractor	IPs: 181.4.225.225:443
Source: Malware configuration extractor	IPs: 24.234.220.88:443
Source: Malware configuration extractor	IPs: 174.58.146.57:443

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: MEO-RESIDENCIALPT MEO-RESIDENCIALPT

Source: Joe Sandbox View	IP Address: 38.2.18.164 38.2.18.164
Source: Joe Sandbox View	IP Address: 2.82.8.80 2.82.8.80

Source: global traffic

TCP traffic: 192.168.2.3:49714 -> 109.130.247.84:2222

Source: unknown

Network traffic detected: IP country count 27

Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.247.84

Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/company/linkedin/jobs?trk=homepage-basic_directory_careersUrl" data-tracking-control-name="homepage-basic_directory_careersUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl" data-tracking-control-name="homepage-basic_directory_adviceDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl" data-tracking-control-name="homepage-basic_directory_articlesDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/companies?trk=homepage-basic_directory_companyDirectoryUrl" data-tracking-control-name="homepage-basic_directory_companyDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl" data-tracking-control-name="homepage-basic_directory_featuredDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/jobs?trk=homepage-basic_directory_jobSearchDirectoryUrl" data-tracking-control-name="homepage-basic_directory_jobSearchDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl" data-tracking-control-name="homepage-basic_directory_learningDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_newsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/newsletters?trk=homepage-basic_directory_newslettersDirectoryUrl" data-tracking-control-name="homepage-basic_directory_newslettersDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/people-search?trk=homepage-basic_directory_peopleSearchDirectoryUrl" data-tracking-control-name="homepage-basic_directory_peopleSearchDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/people?trk=homepage-basic_directory_peopleDirectoryUrl" data-tracking-control-name="homepage-basic_directory_peopleDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_postsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_productsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/schools?trk=homepage-basic_directory_schoolsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_schoolsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl" data-tracking-control-name="homepage-basic_directory_servicesDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl" data-tracking-control-name="homepage-basic_directory_helpCenterUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/jobs?trk=homepage-basic_directory_jobsHomeUrl" data-tracking-control-name="homepage-basic_directory_jobsHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/learning/?trk=homepage-basic_directory_learningHomeUrl" data-tracking-control-name="homepage-basic_directory_learningHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl" data-tracking-control-name="homepage-basic_directory_productsHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl" data-tracking-control-name="homepage-basic_directory_salaryHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/services?trk=homepage-basic_directory_servicesHomeUrl" data-tracking-control-name="homepage-basic_directory_servicesHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/signup?trk=guest_homepage-basic_directory" data-tracking-control-name="guest_homepage-basic_directory" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/aec?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/animation-and-illustration?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/business-analysis-and-strategy?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/cloud-computing-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/database-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/devops?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/diversity-equity-and-inclusion-dei?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/finance-and-accounting?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/graphic-design?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/marketing-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/motion-graphics-and-vfx?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/photography-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/professional-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/small-business-and-entrepreneurship?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/software-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/user-experience?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/video-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/web-design?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/web-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="nav__button-tertiary btn-md btn-tertiary" href="https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join" data-tracking-control-name="guest_homepage-basic_nav-header-join" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <p>LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including <b>professional and job ads</b>) on and off LinkedIn. Learn more in our <a href="https://www.linkedin.com/legal/cookie-policy">Cookie Policy</a>.</p><p>Select Accept to consent or Reject to decline non-essential cookies for this use. You can update your choices at any time in your <a href="https://www.linkedin.com/mypreferences/g/guest-cookies">settings</a>.</p> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: As of July 1, LinkedIn will no longer support the Internet Explorer 11 browser. LinkedIn recommends the new browser from Microsoft. <u data-control-name="ga.ie11.v1" data-tracking-control-name="ga.ie11.v1"><a href="https://www.microsoft.com/edge?form=MY01K8&OCID=MY01K8">Download now</a></u> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-firstBtn" data-tracking-will-navigate href="https://www.linkedin.com/pub/dir/+/+?trk=homepage-basic_brand-discovery_intent-module-firstBtn"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-secondBtn" data-tracking-will-navigate href="https://www.linkedin.com/jobs/jobs-in-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-thirdBtn" data-tracking-will-navigate href="https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="sign-in-form__join-cta btn-md btn-secondary w-column babybear:w-full block mb-3" href="https://www.linkedin.com/signup" data-test-id="sign-in-join-cta" data-tracking-control-name="homepage-basic_sign-in-form_join-cta" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <link rel="alternate" hreflang="x-default" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: sign-in-form__forgot-password--full-width" href="https://www.linkedin.com/uas/request-password-reset?trk=homepage-basic_forgot_password" data-tracking-control-name="homepage-basic_forgot_password" data-tracking-will-navigate>Forgot password?</a> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <link rel="alternate" hreflang="en" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <link rel="alternate" hreflang="en-US" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-primary" data-tracking-control-name="homepage-basic_join-cta" data-tracking-will-navigate href="https://www.linkedin.com/signup?trk=homepage-basic_join-cta" aria-describedby="bottom-cta-section__header"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic" data-tracking-will-navigate href="https://www.linkedin.com/pub/dir/+/+?trk=homepage-basic"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/business-administration-s50111/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/construction-management-s831/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/engineering-s166/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/healthcare-s282/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/it-services-s57547/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/marketing-s2461/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/public-administration-s3697/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/sustainability-s932/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/telecommunications-s314/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/accounting-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/administrative-assistant-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/administrative-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/arts-and-design-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/business-development-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/community-and-social-services-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/consulting-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/customer-service-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/education-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/engineering-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/entrepreneurship-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/finance-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/healthcare-services-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/human-resources-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/information-technology-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/legal-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/marketing-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/media-and-communications-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/military-and-protective-services-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/operations-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/product-management-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/program-and-project-management-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/purchasing-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/quality-assurance-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/real-estate-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/research-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/retail-associate-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/sales-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/support-jobs-h equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary-emphasis flex-shrink babybear:my-auto babybear:mx-[0px]" data-tracking-control-name="homepage-basic_talent-finder-cta" data-tracking-will-navigate href="https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary-emphasis" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/home/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/accessibility?trk=homepage-basic_footer-accessibility" data-tracking-control-name="homepage-basic_footer-accessibility" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy" data-tracking-control-name="homepage-basic_footer-cookie-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy" data-tracking-control-name="homepage-basic_footer-copyright-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy" data-tracking-control-name="homepage-basic_footer-privacy-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-guide" data-tracking-control-name="homepage-basic_footer-community-guide" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/user-agreement?trk=homepage-basic_footer-user-agreement" data-tracking-control-name="homepage-basic_footer-user-agreement" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls" data-tracking-control-name="homepage-basic_footer-guest-controls" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <link rel="canonical" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a class="nav__button-secondary btn-md btn-secondary-emphasis" href="https://www.linkedin.com/login?fromSignIn=true&trk=guest_homepage-basic_nav-header-signin" data-tracking-control-name="guest_homepage-basic_nav-header-signin" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a href="https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_jobs" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a href="https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_learning" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a href="https://www.linkedin.com/pub/dir/+/+?trk=guest_homepage-basic_guest_nav_menu_people" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_people" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a href="https://www.linkedin.com/pulse/topics/home/?trk=guest_homepage-basic_guest_nav_menu_articles" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_articles" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <a href="https://www.linkedin.com/search/results/content?trk=guest_homepage-basic_guest_nav_menu_posts" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_posts" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <form class="google-auth" action="https://www.linkedin.com/uas/login-submit" method="post"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <form data-id="sign-in-form" action="https://www.linkedin.com/uas/login-submit" method="post" novalidate data-js-module-id="d2l-sign-in-form"> equals www.linkedin.com (Linkedin)
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: <meta property="og:url" content="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)

Source: 042_qbot.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 042_qbot.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: 042_qbot.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 042_qbot.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: 042_qbot.dll.dll	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 042_qbot.dll.dll	String found in binary or memory: http://ocsp.digicert.com0C
Source: 042_qbot.dll.dll	String found in binary or memory: http://ocsp.digicert.com0H
Source: 042_qbot.dll.dll	String found in binary or memory: http://ocsp.digicert.com0I
Source: 042_qbot.dll.dll	String found in binary or memory: http://ocsp.digicert.com0O
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: 042_qbot.dll.dll	String found in binary or memory: http://www.digicert.com/CPS0
Source: 042_qbot.dll.dll	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://about.linkedin.com?trk=homepage-basic_footer-about
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ae.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ar.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://at.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://au.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://blog.linkedin.com/?trk=homepage-basic_directory_blogMicrositeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://bo.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://br.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://brand.linkedin.com/policies?trk=homepage-basic_footer-brand-policy
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://business.linkedin.com/sales-solutions?src=li-footer&utm_source=linkedin&utm_medium=f
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ca.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ch.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://cl.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://cn.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://co.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://cr.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://cz.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://de.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://dk.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://do.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ec.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://es.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://fr.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://gh.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://gt.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://hk.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://id.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ie.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://il.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://in.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://it.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://jm.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://jp.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ke.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://kr.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://learning.linkedin.com/?src=li-footer&trk=homepage-basic_directory_learningMicrositeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://lu.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://mx.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://my.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ng.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://nl.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://no.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://nz.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://pa.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://pe.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ph.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://pk.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://pl.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://pr.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://press.linkedin.com/?trk=homepage-basic_directory_pressMicrositeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://pt.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ro.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ru.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://se.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://sg.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/1ztbxc0xawjbjl481u72sso2e
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/292yd0en6qdvkbezeuj71yu4y
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/3l4csbmaa6sv4gtsledhbu9lq
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/4chtt12k98xwnba1nimld2oyg
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/5anw0ar72zvn8xrzj6wvz3jl6
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/5mic7em4akle2l5km6kwwo2hf
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/6ulnj3n2ijcmhej768y6oj1hr
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/7asbl4deqijhoy3z2ivveispv
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8m736dfzskmdn6bwwqz67iiki
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/92eb1xekc34eklevj0io6x4ki
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/9r7bzghkywart99je65bjx5yl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/ann24vsq7r0ux3vipqa1n90gg
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/b0sinzszgdrksde0dzc0leckm
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/b1fxwht7hdbeusleja7ciftsj
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/c9dcz2pyrbwi3sr6xwxigmvlz
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/cyolgscd0imw2ldqppkrb84vo
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dbvmk0tsk0o0hd59fi64z3own
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dkfub4sc7jgzg3o31flfr91rv
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dxf91zhqd2z6b0bwg85ktm5s4
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/e5ka7p8s9n5r0z9p6kpmm3hig
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://static.licdn.com/scds/common/u/images/logos/favicons/v1/favicon.ico
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://sv.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://th.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://tr.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://tt.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://tw.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://uk.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://uy.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://ve.linkedin.com/
Source: 042_qbot.dll.dll	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/accessibility?trk=homepage-basic_footer-accessibility
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/company/linkedin/jobs?trk=homepage-basic_directory_careersUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/companies?trk=homepage-basic_directory_companyDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/jobs?trk=homepage-basic_directory_jobSearchDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/newsletters?trk=homepage-basic_directory_newslettersDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/people-search?trk=homepage-basic_directory_peopleSearchDirectoryU
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/people?trk=homepage-basic_directory_peopleDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/schools?trk=homepage-basic_directory_schoolsDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/accounting-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/administrative-assistant-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/administrative-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/arts-and-design-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/business-development-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/community-and-social-services-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/consulting-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/customer-service-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/education-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/engineering-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/entrepreneurship-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/finance-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/healthcare-services-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/human-resources-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/information-technology-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/jobs-in-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/legal-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/marketing-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/media-and-communications-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/military-and-protective-services-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/operations-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/product-management-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/program-and-project-management-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/purchasing-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/quality-assurance-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/real-estate-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/research-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/retail-associate-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/sales-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs/support-jobs-h
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/jobs?trk=homepage-basic_directory_jobsHomeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/?trk=homepage-basic_directory_learningHomeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/aec?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/animation-and-illustration?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/business-analysis-and-strategy?trk=homepage-basic_learning-
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/cloud-computing-5?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/database-management?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/devops?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/diversity-equity-and-inclusion-dei?trk=homepage-basic_learn
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/finance-and-accounting?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/graphic-design?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/marketing-2?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/motion-graphics-and-vfx?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/photography-2?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/professional-development?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/small-business-and-entrepreneurship?trk=homepage-basic_lear
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/software-development?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/user-experience?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/video-2?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/web-design?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/web-development?trk=homepage-basic_learning-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/legal/cookie-policy
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/legal/user-agreement?trk=homepage-basic_footer-user-agreement
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/login?fromSignIn=true&trk=guest_homepage-basic_nav-header-signin
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/mypreferences/g/guest-cookies
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pub/dir/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/business-administration-s50111/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/construction-management-s831/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/engineering-s166/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/healthcare-s282/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/home/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/home/?trk=guest_homepage-basic_guest_nav_menu_articles
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/it-services-s57547/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/marketing-s2461/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/public-administration-s3697/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/sustainability-s932/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/telecommunications-s314/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/search/results/content?trk=guest_homepage-basic_guest_nav_menu_posts
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/services?trk=homepage-basic_directory_servicesHomeUrl
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/signup
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=guest_homepage-basic_directory
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=homepage-basic_join-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/uas/login-submit
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://www.linkedin.com/uas/request-password-reset?trk=homepage-basic_forgot_password
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://za.linkedin.com/
Source: 1X93SLWC.htm.22.dr	String found in binary or memory: https://zw.linkedin.com/

Source: unknown

DNS traffic detected: queries for: linkedin.com

Source: loaddll32.exe, 00000000.00000002.383261687.000000000102B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: 042_qbot.dll.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 15.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 15.2.rundll32.exe.2980960.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 15.2.rundll32.exe.2980960.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 664

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6ADAACE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6ADA6880
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10018E20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10003A40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100172EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100132F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10016F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10014B53

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100144D8 NtProtectVirtualMemory,NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000A51F NtAllocateVirtualMemory,NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000A93E GetThreadContext,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000AA38 GetLastError,NtResumeThread,FindCloseChangeNotification,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000CAF3 NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,

Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ncryptsslp.dll

Source: 042_qbot.dll.dll

Static PE information: Number of sections : 15 > 10

Source: 042_qbot.dll.dll	ReversingLabs: Detection: 58%
Source: 042_qbot.dll.dll	Virustotal: Detection: 64%

Source: 042_qbot.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_block_row
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 652
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_sample_rows
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,ldiv_round_up
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_block_row
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_sample_rows
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",ldiv_round_up
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",next
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lround_up
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lpeg_write_tables
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 652
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 660
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_block_row
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_sample_rows
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,ldiv_round_up
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_block_row
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_sample_rows
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",ldiv_round_up
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",next
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lround_up
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lpeg_write_tables
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe

Source: C:\Windows\SysWOW64\wermgr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Meyihpxz

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER78EA.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@30/19@2/100

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 15_2_1000D2F7 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 15_2_1000C800 CreateToolhelp32Snapshot,Process32First,FindCloseChangeNotification,

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_block_row

Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{E154713E-25B3-45C5-A3DC-8DA544C3AF30}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{E154713E-25B3-45C5-A3DC-8DA544C3AF30}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{6AEC8A1C-0439-4DEA-95FA-45D0A4E65B5D}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1108
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7048
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5796
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5436

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 042_qbot.dll.dll

Static PE information: More than 104 > 100 exports found

Source: 042_qbot.dll.dll

Static PE information: Image base 0x6ad80000 > 0x60000000

Source: 042_qbot.dll.dll	Static PE information: section name: /4
Source: 042_qbot.dll.dll	Static PE information: section name: /14
Source: 042_qbot.dll.dll	Static PE information: section name: /29
Source: 042_qbot.dll.dll	Static PE information: section name: /41
Source: 042_qbot.dll.dll	Static PE information: section name: /55
Source: 042_qbot.dll.dll	Static PE information: section name: /67

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6AD814B0 GetModuleHandleA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,

Source: 042_qbot.dll.dll

Static PE information: real checksum: 0xc341d should be: 0xbf9af

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 7220 base: 9B3C50 value: E9 63 D7 28 02

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: wermgr.exe, 00000016.00000003.393704756.0000000004A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Windows\SysWOW64\rundll32.exe TID: 4472

Thread sleep count: 192 > 30

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\SysWOW64\wermgr.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 15_2_1000B967 GetSystemInfo,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 15_2_10009E70 FindFirstFileW,FindNextFileW,

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6AD814B0 GetModuleHandleA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6AD81F50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10001015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100021CD mov eax, dword ptr fs:[00000030h]

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6ADC5370 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,EnterCriticalSection,TlsGetValue,GetLastError,TlsGetValue,GetLastError,LeaveCriticalSection,

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 2C70000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 2C40000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 9B3C50

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 2C40000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 2C70000 protect: page read and write

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Windows\SysWOW64\wermgr.exe base: 2C40000 value starts with: 4D5A

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6ADB3D50 cpuid

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6ADC52A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 15_2_1000BC31 GetCurrentProcessId,GetLastError,GetVersionExA,GetWindowsDirectoryW,

Source: rundll32.exe, 0000000F.00000003.383623697.000000000466F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 0000000F.00000003.383623697.000000000466F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: rundll32.exe, 0000000F.00000003.383623697.000000000466F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: rundll32.exe, 0000000F.00000003.383623697.000000000466F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 0000000F.00000003.383623697.000000000466F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: Amcache.hve.8.dr	Binary or memory string: procexp.exe
Source: rundll32.exe, 0000000F.00000003.383623697.000000000466F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 15.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.2980960.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.2980960.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.393595991.00000000045F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.393475523.000000000296A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 15.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.2980960.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.2980960.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.393595991.00000000045F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.393475523.000000000296A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	1 Input Capture	121 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Rundll32	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
042_qbot.dll.dll	58%	ReversingLabs	Win32.Trojan.Zusy
042_qbot.dll.dll	64%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
linkedin.com	13.107.42.14	true	false		high
www.linkedin.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta	1X93SLWC.htm.22.dr	false	high
https://sg.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://nz.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/quality-assurance-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/pulse/topics/marketing-s2461/	1X93SLWC.htm.22.dr	false	high
https://bo.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://cn.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://kr.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://sv.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/signup?trk=guest_homepage-basic_directory	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8	1X93SLWC.htm.22.dr	false	high
https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs	1X93SLWC.htm.22.dr	false	high
https://ec.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://about.linkedin.com?trk=homepage-basic_footer-about	1X93SLWC.htm.22.dr	false	high
https://ie.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://ae.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://uk.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl	1X93SLWC.htm.22.dr	false	high
https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/operations-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/pulse/topics/healthcare-s282/	1X93SLWC.htm.22.dr	false	high
https://in.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://hk.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://at.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/pulse/topics/construction-management-s831/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/education-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/pulse/topics/public-administration-s3697/	1X93SLWC.htm.22.dr	false	high
https://za.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://jm.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://no.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/entrepreneurship-jobs-h	1X93SLWC.htm.22.dr	false	high
https://pe.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://au.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/administrative-assistant-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/signup?trk=homepage-basic_join-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/legal/cookie-policy	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://cr.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://gt.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://ph.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/jobs-in-h	1X93SLWC.htm.22.dr	false	high
https://fr.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/purchasing-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/arts-and-design-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl	1X93SLWC.htm.22.dr	false	high
https://zw.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://co.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://ru.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://ca.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://ke.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/mypreferences/g/guest-cookies	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/9r7bzghkywart99je65bjx5yl	1X93SLWC.htm.22.dr	false	high
https://de.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/jobs/retail-associate-jobs-h	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls	1X93SLWC.htm.22.dr	false	high
https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/5anw0ar72zvn8xrzj6wvz3jl6	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl	1X93SLWC.htm.22.dr	false	high
https://pk.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://jp.linkedin.com/	1X93SLWC.htm.22.dr	false	high
https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta	1X93SLWC.htm.22.dr	false	high
https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca	1X93SLWC.htm.22.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
38.2.18.164	unknown	United States	174	COGENT-174US	true
2.82.8.80	unknown	Portugal	3243	MEO-RESIDENCIALPT	true
70.160.67.203	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
209.171.160.69	unknown	Canada	852	ASN852CA	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
200.84.211.255	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	true
125.99.69.178	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
174.4.89.3	unknown	Canada	6327	SHAWCA	true
121.121.108.120	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
213.64.33.92	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
24.234.220.88	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
67.70.120.249	unknown	Canada	577	BACOMCA	true
73.88.173.113	unknown	United States	7922	COMCAST-7922US	true
72.205.104.134	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
117.195.17.148	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
69.160.121.6	unknown	Jamaica	33576	DIG001JM	true
176.133.4.230	unknown	France	5410	BOUYGTEL-ISPFR	true
183.87.163.165	unknown	India	132220	JPRDIGITAL-INJPRDigitalPvtLtdIN	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
70.49.205.198	unknown	Canada	577	BACOMCA	true
87.221.153.182	unknown	Spain	12479	UNI2-ASES	true
70.50.1.252	unknown	Canada	577	BACOMCA	true
85.101.239.116	unknown	Turkey	9121	TTNETTR	true
181.4.225.225	unknown	Argentina	7303	TelecomArgentinaSAAR	true
100.4.163.158	unknown	United States	701	UUNETUS	true
103.141.50.43	unknown	India	133693	SKISP-AS-INSriKrishnaInternetServicesPrivateLimitedI	true
70.50.83.216	unknown	Canada	577	BACOMCA	true
92.1.170.110	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
188.28.19.84	unknown	United Kingdom	206067	H3GUKGB	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
81.101.185.146	unknown	United Kingdom	5089	NTLGB	true
116.75.63.183	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
124.246.122.199	unknown	Singapore	63850	ENTRUSTICT-AS-APQRHUBPTYLTDTAEntrustICTAU	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
109.130.247.84	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
88.126.94.4	unknown	France	12322	PROXADFR	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
66.241.183.99	unknown	United States	16604	HUNTEL-NETUS	true
180.151.19.13	unknown	India	10029	SHYAMSPECTRA-ASSHYAMSPECTRAPVTLTDIN	true
94.204.202.106	unknown	United Arab Emirates	15802	DU-AS1AE	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
103.212.19.254	unknown	India	132956	VNET-ASVNETNETWORKSPVTLTDIN	true
85.61.165.153	unknown	Spain	12479	UNI2-ASES	true
91.160.70.68	unknown	France	12322	PROXADFR	true
201.143.215.69	unknown	Mexico	8151	UninetSAdeCVMX	true
184.63.133.131	unknown	United States	7155	VIASAT-SP-BACKBONEUS	true
203.109.44.236	unknown	India	135777	NECONN-ASShreenortheastConnectAndServicesPvtLtdIN	true
90.104.151.37	unknown	France	3215	FranceTelecom-OrangeFR	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
2.49.63.160	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
80.6.50.34	unknown	United Kingdom	5089	NTLGB	true
175.156.217.7	unknown	Singapore	4773	MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr	true
103.139.242.6	unknown	India	138798	MUTINY-AS-INMutinySystemsPrivateLimitedIN	true
27.0.48.233	unknown	India	132573	SAINGN-AS-INSAINGNNetworkServicesIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
173.17.45.60	unknown	United States	30036	MEDIACOM-ENTERPRISE-BUSINESSUS	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
70.64.77.115	unknown	Canada	6327	SHAWCA	true
87.252.106.39	unknown	Italy	48544	TECNOADSL-ASIT	true
79.77.142.22	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	true
98.163.227.79	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
93.187.148.45	unknown	United Kingdom	8680	SURE-INTERNATIONAL-LIMITEDGB	true
186.75.95.6	unknown	Panama	11556	CableWirelessPanamaPA	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
45.62.70.33	unknown	Canada	40440	NRTC-CA	true
83.249.198.100	unknown	Sweden	39651	COMHEM-SWEDENSE	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
47.199.241.39	unknown	United States	5650	FRONTIER-FRTRUS	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
199.27.66.213	unknown	United States	40608	HCTNEBRASKAUS	true
200.44.198.47	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
86.173.2.12	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
45.62.75.250	unknown	Canada	40440	NRTC-CA	true
92.154.17.149	unknown	France	3215	FranceTelecom-OrangeFR	true
90.29.86.138	unknown	France	3215	FranceTelecom-OrangeFR	true
174.58.146.57	unknown	United States	7922	COMCAST-7922US	true
223.166.13.95	unknown	China	17621	CNCGROUP-SHChinaUnicomShanghainetworkCN	true
5.192.141.228	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
75.98.154.19	unknown	United States	32444	SAFELINK-MVUS	true
77.126.99.230	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
74.12.147.139	unknown	Canada	577	BACOMCA	true
92.9.45.20	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
113.11.92.30	unknown	Bangladesh	7565	BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD	true
77.86.98.236	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	true
103.140.174.20	unknown	India	138763	PRAVEEN1-ASPraveenTelecomPvtLtdIN	true
78.192.109.105	unknown	France	12322	PROXADFR	true
78.82.143.154	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	882935
Start date and time:	2023-06-07 01:03:42 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 36s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	042_qbot.dll.dll (renamed file extension from dat to dll, renamed because original name is a hash value)
Original Sample Name:	042_qbot.dll.dat
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@30/19@2/100
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 27.4% (good quality ratio 26.1%) Quality average: 78.2% Quality standard deviation: 25.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.42.65.92, 13.107.42.14
Excluded domains from analysis (whitelisted): www-linkedin-com.l-0005.l-msedge.net, l-0005.l-msedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, watson.telemetry.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 5436 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
01:04:46	API Interceptor	1x Sleep call for process: loaddll32.exe modified
01:04:48	API Interceptor	4x Sleep call for process: WerFault.exe modified
01:04:56	API Interceptor	9x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_16e4a039\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9069485680359128
Encrypted:	false
SSDEEP:	192:M91zi40oX1HBUZMX4jed+F/u7suS274ItWc:Gzi+XlBUZMX4jew/u7suX4ItWc
MD5:	3DAF0239E931D9A9F550949CD411F8D9
SHA1:	D5852A94D39502D72A1881CFCAF5B0A65B91AC14
SHA-256:	8B4AD29DDE48A460FD413CEC88AD7E48A9DCD1906BFAD0F4F3277FB794BF0B76
SHA-512:	50BEC91B7AA356819B0B155F00EA442A6380AE1571D137B3FAB4765880C93FCF78BABAFB36203791C035A7C23231343E86EC2C5D0265DCC76517A5510E56D8FD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.5.9.8.6.7.8.8.0.7.2.4.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.5.9.8.6.8.0.2.1.3.4.7.1.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.d.8.6.2.4.3.-.5.9.8.f.-.4.4.1.f.-.9.5.c.2.-.a.9.f.3.5.8.4.8.9.4.9.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.2.e.4.8.e.7.-.6.0.0.9.-.4.4.4.0.-.8.1.a.8.-.e.b.f.d.1.4.9.6.7.5.b.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.5.4.-.0.0.0.1.-.0.0.1.f.-.0.3.6.c.-.f.f.b.3.1.6.9.9.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_7cd6569328c9cf945daabde1681ed6f3f4988cde_82810a17_1078a375\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9070882023503786
Encrypted:	false
SSDEEP:	192:LdjiW0oXAHBUZMX4jed+F/u7suS274ItWc:JjiQXoBUZMX4jew/u7suX4ItWc
MD5:	25A03C50219D78A6BE8F5CE36230564E
SHA1:	132FFA36671673DC8F23B471590C4B6131631A01
SHA-256:	77DCEAF8822B7A02CC6B4CF9EEF14D0CB8FB68EE82C101FF88709288FE897FE3
SHA-512:	DAD99802459F5A5D97610818112D25B4C656E66731AD1ED25D08577DFB9136517682EE6562E5F7FD390C00CF0679C0DCC5F578AFEAF42E207C9CE18F3B625CC9
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.5.9.8.6.8.7.3.9.0.4.5.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.5.9.8.6.8.8.8.2.7.9.5.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.8.6.5.8.7.7.f.-.e.8.4.b.-.4.1.7.6.-.8.8.1.0.-.4.1.f.2.6.8.5.7.c.2.e.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.7.d.b.d.9.f.-.6.7.c.0.-.4.9.9.a.-.8.e.f.6.-.b.5.0.7.3.b.4.e.0.3.8.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.8.8.-.0.0.0.1.-.0.0.1.f.-.d.8.a.6.-.7.0.b.9.1.6.9.9.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_7cd6569328c9cf945daabde1681ed6f3f4988cde_82810a17_16fca039\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9069577957202795
Encrypted:	false
SSDEEP:	192:ym8liM0oXxHBUZMX4jed+F/u7suS274ItWc:yiKXBBUZMX4jew/u7suX4ItWc
MD5:	F811A2CCEA345F8E70F17CC93E088492
SHA1:	DA9C9159572AEFF9176EE8A4AC35F1E4F2220312
SHA-256:	F7A3F5135AE1B818003DA0AE800D004C6215BEF2932506283C8FAE9F6CD7F5EE
SHA-512:	21CBA1B52A440E5ACED92AEC372B590DF15467E5FF0FDAAA2543FFA264E6D9CA7485DFB58C4FE9C01AA0FED7CD740929B3AF4279BDDA8E899627BF84B8126BE5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.5.9.8.6.7.8.7.9.7.9.1.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.5.9.8.6.8.0.2.0.4.1.4.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.c.f.7.b.d.8.-.8.6.c.3.-.4.a.2.6.-.8.8.e.2.-.8.9.e.c.b.3.6.4.7.3.b.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.8.c.9.a.f.8.6.-.2.6.7.b.-.4.1.6.7.-.8.3.4.3.-.a.0.8.2.b.5.2.8.a.4.3.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.3.c.-.0.0.0.1.-.0.0.1.f.-.c.1.1.4.-.f.b.b.3.1.6.9.9.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f72750b22a9214184114f6be25e810eecaece948_82810a17_1beca365\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9068743082243313
Encrypted:	false
SSDEEP:	192:iFDia0oXyHBUZMX4jed+F/u7suS274ItWc:cDiMXKBUZMX4jew/u7suX4ItWc
MD5:	2305E45971941A8220077AB904406D3F
SHA1:	4B96C618B06FE4D1B42DD8C53BFF53D46B9E64D4
SHA-256:	BB8ECFFE8C881794CAE3736A648E3C9171321F203A9D46995DE4E19740FE6BB6
SHA-512:	C76F9CEB12E0FF693C02BFE2BDA990F87FA6185BC553B6E36F56E3B938CB06C350BF1B89076280813EEABA6E72E05A355C2CC533E960BA28522245FCFFFD7B9B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.5.9.8.6.8.7.4.0.7.2.9.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.5.9.8.6.8.8.8.6.0.4.1.4.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.2.3.3.8.0.7.-.3.c.b.2.-.4.d.5.0.-.8.7.4.0.-.0.c.3.9.2.5.2.4.c.9.3.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.5.1.e.e.d.4.-.6.d.2.d.-.4.8.d.5.-.8.6.2.e.-.b.3.9.1.f.6.2.5.c.d.1.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.a.4.-.0.0.0.1.-.0.0.1.f.-.3.c.8.0.-.8.9.b.9.1.6.9.9.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78EA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jun 7 08:04:39 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	44234
Entropy (8bit):	2.1083789692518344
Encrypted:	false
SSDEEP:	192:IvAwn0q4O5SkbS9SwizPUgmNQpKCXgXTZZ2Ha:m0o5LbS9GQNQZXW+a
MD5:	4F0217F82F1EB1CC660097F6093AB784
SHA1:	A4C7FB4F3F5F45FDCCE2BCBC538837B7FF2D6C9A
SHA-256:	8FDAA51A6815D700ED46B7892B4D6601FB88367B5547A5EEDAB89F248271D1B9
SHA-512:	64E5DF41AEACBF44032A4D207DB9B8060A4C2961225BFA7F3E51728A43043388F927F91EE28D789B01A0A6D93D5948FF93B074CD674AE2981E57AAF83E68A234
Malicious:	false
Preview:	MDMP....... ........:.d.........................................,..........T.......8...........T..........................0................................................................................U...........B..............GenuineIntelW...........T.......<....:.d.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7959.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jun 7 08:04:39 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	46090
Entropy (8bit):	2.049290592546687
Encrypted:	false
SSDEEP:	192:IxIuwn2coO5Skby2Rs9PA1uZ5FP5MS7v4BG8IzOKTnR4:j225Lby822uzFykMIyKTR
MD5:	7CE958E3FCCC091A1C14215C35D246A7
SHA1:	47A4A263F0617483B7C45C3BAC77B890EC21583A
SHA-256:	7F45F3ED8E88D4B9E75E144905BB56EBB4C5859454CFC618E0289CB274959023
SHA-512:	88C5216BE0F78178BD46406E8F7A57AE20EC8DAFD462896839528875B433116662FA63ACDFFB338FC77151398150B5336EBB131FF43DD4B68BD97B3E3F397F02
Malicious:	false
Preview:	MDMP....... ........:.d.........................................,..........T.......8...........T...........P...............0................................................................................U...........B..............GenuineIntelW...........T.......T....:.d.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A82.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8248
Entropy (8bit):	3.6919259351458082
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiZs6u6YaF6fgmfTrS/H9Cprg89b+xsf/OKm:RrlsNii6u6YY6fgmfTrSI+qfS
MD5:	1FE30ABE2C4425EBA9707BFC879BB363
SHA1:	2146AA5B580E9D2F46813DD6737A162F143549AD
SHA-256:	E0839BA1B1E41BC42F352D283A510777B4CC0F04AC8DCA2F434689B5B4AB5FDE
SHA-512:	5D81953C64B58076C7C64D69759BC57E7EA6D9A3568A70B7D81BC2415637178AEE455D3B101DDF250FF51802F3DA8B76B42382ECC2B331D409BEDAEF088FCB63
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.3.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AE0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8244
Entropy (8bit):	3.6911056195314447
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi9d6z6YeK6hgmfTTS/H9Cprp89b+ssf0HEKm:RrlsNi36z6YD6hgmfTTSD+/fh
MD5:	F466D95D274A391A69D7BF4404A5A30C
SHA1:	383B3675B370BD56B6BBA81B0F72FDC4B62C8EBF
SHA-256:	2958E9EF97BA799EDA179F2340637DBEEB08CEF7742AAA909D060EC2BEDD4528
SHA-512:	FD1B9E3D0AFF7FBFAAF182680EF43A43C6F217B8F9EBEF5707983111A20FE82F18BE1B3720A22B6ADD07FF13CF867A4F56FDEE1F733DE77F876297AB2EF7180D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.1.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B0F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	4.450581457310216
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9AOWgc8sqYjj8fm8M4JCdsdFKE+q8/MQ4SrSid:uITfNTvgrsqYcJsEoDWid
MD5:	CB12336BACD233D023852954771FF71B
SHA1:	CEC8B867E8CC278DDBCC2BF81917A5705559C77D
SHA-256:	8767761B226A47C42A5A51EAAAB8B8CBB4381E02716F1F5FF609420A36C19C01
SHA-512:	85DEBCA74D559D39A24B8723F314046B16A2DB3F9E425C9C2F793BF0848545179184BFF99E8D963E3290873CDB88A13D1A02005E0D778A54B44E7E99470A6FEA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2074635" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B4F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	4.452196030168851
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9AOWgc8sqYjea8fm8M4JCdspF9RlSJ+q8/MA4SrS1d:uITfNTvgrsqYSvJZlSJIDW1d
MD5:	5835CA99C84AE44D846427D8D149F56E
SHA1:	34706F73738EA66E54409305461B3B0083CDC5D5
SHA-256:	2C986D702C0A23602B2D1CE777183E57BF2E1B0D993A2BD455F084F16DDD11BB
SHA-512:	8F7E6E8EDAFE548F4997848CC7306C8E323F822DF293C0BFC56BBC0B57A20F7715874207980DED1C65F7F872EBD6C05E5C070D415883A93C4C062F14E0549A16
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2074635" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A7C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jun 7 08:04:47 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	43994
Entropy (8bit):	2.128746637822403
Encrypted:	false
SSDEEP:	192:Q7+kwnVl4O5Skb8k9XP1zyhCS1AiotX7vOhiQV4N:Z3VJ5Lb8kB9+k9iotX7uK
MD5:	357DBF89DFDE5EB16489508BF3AA9BB0
SHA1:	572B12BE82CFEBEFF6A81FF44672FCC69819BF51
SHA-256:	09F0A88AD57749C74EA08EEAA4E0CDB5334B4E1014EFAFEAFC04623248BE9043
SHA-512:	472A089B12EA2EA4804F267C6DDA5319B85F422E357F09CE81E7DEC6149BD6CA08C14240FD8F7E28AEB9F2663C355278941217E296A3D5B4BE336C1C9369D962
Malicious:	false
Preview:	MDMP....... ........:.d.........................................,..........T.......8...........T..........................0................................................................................U...........B..............GenuineIntelW...........T............:.d.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A8C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jun 7 08:04:47 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	45078
Entropy (8bit):	2.0784012736743787
Encrypted:	false
SSDEEP:	192:QZywncboO5SkbNqxYOXDc1GrMN1UPSDK7qL2lCE7/er:6cj5LbEXDc1GRSL2llw
MD5:	7AD9873640780E21556A936C1F7F4F0E
SHA1:	25BBB9B17C40BDDC6F44BA1EE882E99E7FBE5304
SHA-256:	DB092B4F13FD0DA3F55C29DB4E79D2A672CC8EEE23BF200BC998A23711776A63
SHA-512:	55AAE60C63A0FD98251D189417F57DF23FDC1EB0A256A3E7D2FAC927587B60DF24B76397B494136B12478D2EDA8B9578F693549F597F0F1AE430829E039C82D0
Malicious:	false
Preview:	MDMP....... ........:.d.........................................,..........T.......8...........T...........................0................................................................................U...........B..............GenuineIntelW...........T............:.d.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C33.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	3.690063539190381
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi2r6P6YqF6QgmfTrS/H9Cprx89bXusfk8dm:RrlsNi66P6YQ6QgmfTrSbXtfkr
MD5:	A414C8BDA87601C971031FD02977031C
SHA1:	F178D2573A95F3B139E25B74E57335E360CE9F37
SHA-256:	5A3C8BACF551A1FAFB47A1A27C2BE5902C82F96F09DCD6948F612050303F9DDC
SHA-512:	DBBAC53C3989653B04BEC75287AB3337951A5589A0B83FD684F53DA0E81C6DF108088D5F81D1E354D1625FCC46075071CC9D2D62BEF81F3C7FE28A31CCCBD2D9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.4.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C52.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	3.6906659355862796
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi4u656Yq76QgmfTLS/H9CprOx89bX6sfHdm:RrlsNih656Ye6QgmfTLSUXZfg
MD5:	36060F0813FC354BE8C1FF7E1CEFD24E
SHA1:	E7D3F6693D1E7966249D6ADA35BD459D76509E1E
SHA-256:	1623A1F34587D9132E453B26AB7F6342D05808B129AF46137A40C4FA2C057E38
SHA-512:	E0F07FA512E49BDF638B183741210B16B4CCCC5FFB34E2A34D270EE9AB661B74265B2070B49ADCA716D8FF69D926FDE99D3A349072BD5F62958A85CAABEC8EE3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CC0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	4.449642162249726
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9AOWgc8sqYjH8fm8M4JCdspFm0k+q8/M24SrSUd:uITfNTvgrsqYQJ80kuDWUd
MD5:	99AE0358000C8108833438951A281DDA
SHA1:	6132397011E34102CDA1A89A035FA34793A3D950
SHA-256:	2A3F6189A05D0E48C2E56370A3AC0982C2E72DB35AC742F5079524EFA83188A6
SHA-512:	F80E61548480E34AFA63560E8C47F3AA7B009FB9E20AEC62329C92761F9F594BF3615AFDF845D48295925F29BA8DFE250D9AAFC5C9B47192655A2115195CB77A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2074635" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CD0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	4.452052282420109
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9AOWgc8sqYjd8fm8M4JCdsdFS+q8/Mg4SrSEd:uITfNTvgrsqYuJw4DWEd
MD5:	995B428776C7CFEC012BA14EC4E1F11E
SHA1:	0F2F08CC971BD48F840507229CF216A702D04B34
SHA-256:	1403BD433F6EBCB164B8A6790DE64FB803600335BBF417BBDE1C62B07D8E45D5
SHA-512:	D552150CC82BA5EF573638086BC0672C0ECC9876DA7A8C92AE37E7BDA7534321ED93623E808926AB5E09BC6C0C47DC11DEF06A3789C0DEA7AD0A2155237D78D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2074635" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\1X93SLWC.htm

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (540)
Category:	dropped
Size (bytes):	125262
Entropy (8bit):	4.778268296671285
Encrypted:	false
SSDEEP:	3072:1+SW4o9/vKI0pUuqGVCD8pAHQzHk9gIFFRKJ1jUdqoN8eB:1+SA8eB
MD5:	47D8225A9E27539BD32E7264CF77F444
SHA1:	A666682A7A432F0496A1E0ACF03F99F94C75647B
SHA-256:	2F36310CA434CBD37746E6806B6E9D85AFE1DA86F0972D07F7828E27C655379C
SHA-512:	9F171EBFFB02C138F07A358CB0514DDCE6E7F2BBAAB64BF96B36002DF730F036D1ACA965666170FF52E4F9427046736CFF37F9155E3CF9F6DFF64A5C3E1D2BAF
Malicious:	false
Preview:	<!DOCTYPE html>... . . . . . . . . . .. . . . . .. . <html lang="en">. <head>. <meta name="pageKey" content="d_homepage-guest-home">. --> <meta name="locale" content="en_US">. <meta id="config" data-app-version="2.1.790" data-call-tree-id="AAX9fhafJH9ZRbVOz62nnA==" data-jet-tags="guest-homepage" data-multiproduct-name="homepage-guest-frontend" data-service-name="homepage-guest-frontend" data-browser-id="dc569e29-f7dd-417c-88a2-6d2dc9c10878" data-enable-page-view-heartbeat-tracking data-disable-comscore-tracking data-page-instance="urn:li:page:d_homepage-guest-home;7tUZ2aPzTBWUIjL+fsC33g==" data-disable-jsbeacon-pagekey-suffix="false" data-member-id="0">.. <link rel="canonical" href="https://www.linkedin.com/">. <link rel="alternate" hreflang="de" href="https://de.linkedin.com/">. <link rel="alternate" hreflang="en-IE" href="https://ie.linkedin.com/">. <link rel="alternate"

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.294316661842153
Encrypted:	false
SSDEEP:	12288:i88NLgyojp1EHLm0HHPGxpdCeJLfL8daJnJz4aXpxzcca+THnH66CKj:QNLgyojp1EHLm0Efd
MD5:	09638B666048B187A6E70D76F25001F7
SHA1:	5892C325915E1A7A98509ED76E4CF96093AE2456
SHA-256:	AD8EAA0CAD4EF00D972F8CCB179A35D3C57811BED76E76135CDCFD991F05511B
SHA-512:	176864989CB150302BBC4C83DE8E56641995F4579119606B722F02E90AAE2816328BF86FD29607A170F2E0664811B1E73617807A5A0905F6FD802864C648CE5C
Malicious:	false
Preview:	regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.8213102723382906
Encrypted:	false
SSDEEP:	768:aQURftx1fJ4JUHQAJfzqiVx0kqQvSC9O2MY+qE:ezRhK
MD5:	873FFB75DBA206A5BC148FE4F7CA634E
SHA1:	0F12E02156348CD15AEABC3A55513101ED06A1C8
SHA-256:	58B940B239865952BD24C8C7E77DDD516F7E3C8B9FB75EE87D47A2B053973EB7
SHA-512:	FEB0D736360FABAC712386EAC925522FBEFCC58D0863F78F67551A001FF3F86549342B3759212F863C05D624DCA6877DB425F7F262AC020234B5E7AB79363536
Malicious:	false
Preview:	regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm........................................................................................................................................................................................................................................................................................................................................................HvLE.n......i...........4...B.....[...@..........0...................0..hbin................p.\..,..........nk,............h........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ............ ........................... .......Z.......................Root........lf......Root....nk .........................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	6.610461945368989
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	042_qbot.dll.dll
File size:	741925
MD5:	8c18224b2fcb618bb4305a8687b3bb22
SHA1:	c0a9a8cb468d0f9b185fa1112683612c01c60673
SHA256:	d93d05a84c4d9579accd5dc839ee9f8f7e7f54c623e37175a59146664530dc3d
SHA512:	5b97a909cd2bca451bbc75cfb9e16ed7a16ec34a25fa1c41d9fa120819e54d349bace2116e31c91fddc5b683153dba2829830c39e0a3d9677f8efcadee5e04db
SSDEEP:	12288:zDxy+2MIBYYimb3oG11xfTUUk0uU7/GQ4vbnWj68N:Pg+2MIBYkb4G11hTQ05bGM
TLSH:	A4F43B83A6826C92DBE61435CD9ED33667347A5C83F3DBB3F514A9E27D631A33944208
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^.WW.2..C......!.....L..........p........`.....j............>............ .......4........ ......................0..S..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x6ad81470
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x6ad80000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x5757085E [Tue Jun 7 17:46:06 2016 UTC]
TLS Callbacks:	0x6adc4bf0, 0x6adc4ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1cba0e23b706e0bfbc0a4cb9b6bd80fb

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 1Ch
mov edx, dword ptr [esp+24h]
mov dword ptr [6ADF2030h], 00000000h
cmp edx, 01h
je 00007F2A9879D03Ch
mov ecx, dword ptr [esp+28h]
mov eax, dword ptr [esp+20h]
call 00007F2A9879CE32h
add esp, 1Ch
retn 000Ch
lea esi, dword ptr [esi+00000000h]
mov dword ptr [esp+0Ch], edx
call 00007F2A987E0E1Ch
mov edx, dword ptr [esp+0Ch]
jmp 00007F2A9879CFF9h
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 10h
mov ebx, dword ptr [6ADF4124h]
mov dword ptr [esp], 6ADC7000h
call ebx
mov esi, eax
sub esp, 04h
test esi, esi
mov eax, 00000000h
je 00007F2A9879D04Bh
mov dword ptr [esp], 6ADC7000h
call dword ptr [6ADF4144h]
sub esp, 04h
mov dword ptr [6ADF201Ch], eax
mov dword ptr [esp+04h], 6ADC7013h
mov dword ptr [esp], esi
call dword ptr [6ADF4128h]
sub esp, 08h
test eax, eax
je 00007F2A9879D033h
mov dword ptr [esp+04h], 6ADF2004h
mov dword ptr [esp], 6ADEC000h
call eax
mov eax, dword ptr [6ADC6020h]
test eax, eax
je 00007F2A9879D05Ah
mov dword ptr [esp], 6ADC7029h
call ebx
mov edx, 00000000h
sub esp, 04h
test eax, eax
je 00007F2A9879D038h
mov dword ptr [esp+04h], 00DC7037h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x73000	0xc53	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74000	0x5a4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8df10	0x1cc8	/55
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x77000	0x1790	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x76000	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x74108	0xcc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x44ad4	0x44c00	False	0.4085191761363636	data	6.536085286601772	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x46000	0x24	0x200	False	0.068359375	data	0.444378072732298	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x47000	0x240c4	0x24200	False	0.042259137110726645	data	2.965728380228879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
/4	0x6c000	0x5954	0x5a00	False	0.266796875	data	4.8715558095609435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x72000	0x3e4	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x73000	0xc53	0xe00	False	0.41322544642857145	data	4.9102030514161354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x74000	0x5a4	0x600	False	0.42578125	data	4.85888040741761	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x75000	0x2c	0x200	False	0.0546875	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x76000	0x20	0x200	False	0.052734375	data	0.28655982431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x77000	0x1790	0x1800	False	0.8084309895833334	data	6.600381492361927	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/14	0x79000	0x38	0x200	False	0.068359375	Matlab v4 mat-file (little endian) *, rows 2, columns 262144	0.23653878450968063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/29	0x7a000	0xba4	0xc00	False	0.4329427083333333	data	5.509643399768958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/41	0x7b000	0x87	0x200	False	0.2265625	data	1.630440230936631	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/55	0x7c000	0x24f4d	0x25000	False	0.9180215371621622	data	7.808486707251028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/67	0xa1000	0x38	0x200	False	0.1171875	data	0.6947581054952565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, InterlockedCompareExchange, InterlockedExchange, LeaveCriticalSection, LoadLibraryA, QueryPerformanceCounter, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery

msvcrt.dll

__dllonexit, _amsg_exit, _initterm, _iob, _lock, _onexit, _unlock, abort, calloc, exit, ferror, fflush, fprintf, fread, free, fwrite, getenv, malloc, memcpy, memset, sprintf, sscanf, strlen, strncmp, vfprintf

Exports

Name	Ordinal	Address
lcopy_block_row	1	0x6adade90
lcopy_sample_rows	2	0x6adade30
ldiv_round_up	3	0x6adaddf0
linit_1pass_quantizer	4	0x6adabf70
linit_2pass_quantizer	5	0x6adadc70
linit_c_coef_controller	6	0x6ad82a40
linit_c_main_controller	7	0x6ad8c450
linit_c_master_control	8	0x6ad8f7f0
linit_c_prep_controller	9	0x6ad933c0
linit_color_converter	10	0x6ad83cf0
linit_color_deconverter	11	0x6ad9a0e0
linit_compress_master	12	0x6ad8c240
linit_d_coef_controller	13	0x6ad97f90
linit_d_main_controller	14	0x6ad9d790
linit_d_post_controller	15	0x6ada4f10
linit_downsampler	16	0x6ad93f00
linit_forward_dct	17	0x6ad84840
linit_huff_decoder	18	0x6ad9c280
linit_huff_encoder	19	0x6ad8c190
linit_input_controller	20	0x6ad9d100
linit_inverse_dct	21	0x6ad9a8b0
linit_marker_reader	22	0x6ad9fd60
linit_marker_writer	23	0x6ad8e8a0
linit_master_decompress	24	0x6ada0a60
linit_memory_mgr	25	0x6adaf3e0
linit_merged_upsampler	26	0x6ada3760
linit_phuff_decoder	27	0x6ada4af0
linit_phuff_encoder	28	0x6ad92de0
linit_upsampler	29	0x6ada55e0
lpeg_CreateCompress	30	0x6ad815b0
lpeg_CreateDecompress	31	0x6ad94f40
lpeg_abort	32	0x6ad8fb40
lpeg_abort_compress	33	0x6ad81730
lpeg_abort_decompress	34	0x6ad95150
lpeg_add_quant_table	35	0x6ad8fc20
lpeg_alloc_huff_table	36	0x6ad8fbf0
lpeg_alloc_quant_table	37	0x6ad8fbc0
lpeg_calc_output_dimensions	38	0x6ada0270
lpeg_consume_input	39	0x6ad95430
lpeg_copy_critical_parameters	40	0x6ad94c60
lpeg_crop_scanline	105	0x6ad95bb0
lpeg_default_colorspace	41	0x6ad8fe60
lpeg_destroy	42	0x6ad8fb90
lpeg_destroy_compress	43	0x6ad81720
lpeg_destroy_decompress	44	0x6ad95140
lpeg_fdct_float	45	0x6ada5ce0
lpeg_fdct_ifast	46	0x6ada5ec0
lpeg_fdct_islow	47	0x6ada60e0
lpeg_fill_bit_buffer	48	0x6ad9b0a0
lpeg_finish_compress	49	0x6ad817f0
lpeg_finish_decompress	50	0x6ad95740
lpeg_finish_output	51	0x6ad963f0
lpeg_free_large	52	0x6adaf570
lpeg_free_small	53	0x6adaf550
lpeg_gen_optimal_table	54	0x6ad8bcf0
lpeg_get_large	55	0x6adaf560
lpeg_get_small	56	0x6adaf540
lpeg_has_multiple_scans	57	0x6ad95700
lpeg_huff_decode	58	0x6ad9b1e0
lpeg_idct_1x1	59	0x6adab430
lpeg_idct_2x2	60	0x6adab130
lpeg_idct_4x4	61	0x6adaace0
lpeg_idct_float	62	0x6ada6380
lpeg_idct_ifast	63	0x6ada6880
lpeg_idct_islow	64	0x6ada6ea0
lpeg_input_complete	65	0x6ad956c0
lpeg_make_c_derived_tbl	66	0x6ad8b7a0
lpeg_make_d_derived_tbl	67	0x6ad9ac10
lpeg_mem_available	68	0x6adaf580
lpeg_mem_dest	102	0x6ad966f0
lpeg_mem_init	69	0x6adaf5b0
lpeg_mem_src	103	0x6ad969e0
lpeg_mem_term	70	0x6adaf5c0
lpeg_new_colormap	71	0x6ada09f0
lpeg_open_backing_store	72	0x6adaf590
lpeg_quality_scaling	73	0x6ad8fda0
lpeg_read_coefficients	74	0x6ada58d0
lpeg_read_header	75	0x6ad95160
lpeg_read_raw_data	76	0x6ad962c0
lpeg_read_scanlines	77	0x6ad95d90
lpeg_resync_to_restart	78	0x6ad9fc20
lpeg_save_markers	79	0x6ad9fed0
lpeg_set_colorspace	80	0x6ad90910
lpeg_set_defaults	81	0x6ad902a0
lpeg_set_linear_quality	82	0x6ad8fd40
lpeg_set_marker_processor	83	0x6ad9ffb0
lpeg_set_quality	84	0x6ad8fdd0
lpeg_simple_progression	85	0x6ad90d50
lpeg_skip_scanlines	104	0x6ad95e30
lpeg_start_compress	86	0x6ad81a50
lpeg_start_decompress	87	0x6ad95ad0
lpeg_start_output	88	0x6ad96380
lpeg_std_error	89	0x6ada5c70
lpeg_stdio_dest	90	0x6ad96680
lpeg_stdio_src	91	0x6ad96930
lpeg_suppress_tables	92	0x6ad81740
lpeg_write_coefficients	93	0x6ad94ae0
lpeg_write_m_byte	94	0x6ad819e0
lpeg_write_m_header	95	0x6ad81980
lpeg_write_marker	96	0x6ad818f0
lpeg_write_raw_data	97	0x6ad81bb0
lpeg_write_scanlines	98	0x6ad81ae0
lpeg_write_tables	99	0x6adadeb0
lround_up	100	0x6adade10
next	101	0x6ad819f0

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3109.130.247.844971422222404302 06/07/23-01:07:51.615603	TCP	2404302	ET CNC Feodo Tracker Reported CnC Server TCP group 2	49714	2222	192.168.2.3	109.130.247.84

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2023 01:07:51.615602970 CEST	49714	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:07:54.619105101 CEST	49714	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:00.744590998 CEST	49714	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:07.814640999 CEST	49715	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:10.823513031 CEST	49715	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:16.824029922 CEST	49715	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:25.967291117 CEST	49716	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:28.981441975 CEST	49716	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:34.997510910 CEST	49716	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:42.096127033 CEST	49717	2222	192.168.2.3	109.130.247.84
Jun 7, 2023 01:08:45.111337900 CEST	49717	2222	192.168.2.3	109.130.247.84

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2023 01:07:50.078953981 CEST	51139	53	192.168.2.3	8.8.8.8
Jun 7, 2023 01:07:50.100409985 CEST	53	51139	8.8.8.8	192.168.2.3
Jun 7, 2023 01:07:50.573241949 CEST	52955	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 7, 2023 01:07:50.078953981 CEST	192.168.2.3	8.8.8.8	0xf20	Standard query (0)	linkedin.com	A (IP address)	IN (0x0001)	false
Jun 7, 2023 01:07:50.573241949 CEST	192.168.2.3	8.8.8.8	0xbbe5	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 7, 2023 01:07:50.100409985 CEST	8.8.8.8	192.168.2.3	0xf20	No error (0)	linkedin.com		13.107.42.14	A (IP address)	IN (0x0001)	false
Jun 7, 2023 01:07:50.611964941 CEST	8.8.8.8	192.168.2.3	0xbbe5	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

Target ID:	0
Start time:	01:04:36
Start date:	07/06/2023
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll"
Imagebase:	0xbd0000
File size:	126464 bytes
MD5 hash:	3B4636AE519868037940CA5C4272091B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exePID: 7160, Parent PID: 6868

General

Target ID:	1
Start time:	01:04:36
Start date:	07/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 3680, Parent PID: 6868

General

Target ID:	2
Start time:	01:04:37
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 5436, Parent PID: 6868

General

Target ID:	3
Start time:	01:04:37
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_block_row
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 1108, Parent PID: 3680

General

Target ID:	4
Start time:	01:04:37
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",#1
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WerFault.exePID: 5804, Parent PID: 1108

General

Target ID:	8
Start time:	01:04:38
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 664
Imagebase:	0xe20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WerFault.exePID: 5812, Parent PID: 5436

General

Target ID:	9
Start time:	01:04:38
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 652
Imagebase:	0xe20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 676, Parent PID: 6868

General

Target ID:	10
Start time:	01:04:40
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,lcopy_sample_rows
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 4144, Parent PID: 6868

General

Target ID:	11
Start time:	01:04:43
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\042_qbot.dll.dll,ldiv_round_up
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7048, Parent PID: 6868

General

Target ID:	12
Start time:	01:04:46
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_block_row
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7076, Parent PID: 6868

General

Target ID:	13
Start time:	01:04:46
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lcopy_sample_rows
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7132, Parent PID: 6868

General

Target ID:	14
Start time:	01:04:46
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",ldiv_round_up
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7140, Parent PID: 6868

General

Target ID:	15
Start time:	01:04:46
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",next
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000000F.00000002.393595991.00000000045F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000000F.00000002.393475523.000000000296A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Analysis Process: rundll32.exePID: 2240, Parent PID: 6868

General

Target ID:	16
Start time:	01:04:46
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lround_up
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 5796, Parent PID: 6868

General

Target ID:	17
Start time:	01:04:46
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\042_qbot.dll.dll",lpeg_write_tables
Imagebase:	0x20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 4144, Parent PID: 7048

General

Target ID:	20
Start time:	01:04:47
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 652
Imagebase:	0xe20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7076, Parent PID: 5796

General

Target ID:	21
Start time:	01:04:47
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 660
Imagebase:	0xe20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: wermgr.exePID: 7220, Parent PID: 7140

General

Target ID:	22
Start time:	01:04:51
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x9a0000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 042_qbot.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_16e4a039\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_7cd6569328c9cf945daabde1681ed6f3f4988cde_82810a17_1078a375\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_7cd6569328c9cf945daabde1681ed6f3f4988cde_82810a17_16fca039\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f72750b22a9214184114f6be25e810eecaece948_82810a17_1beca365\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78EA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7959.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A82.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AE0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B0F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B4F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A7C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A8C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C33.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C52.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CC0.tmp.xml

Windows Analysis Report
042_qbot.dll.dll