Windows Analysis Report
pcre2-16.dll

Overview

General Information

Sample name: pcre2-16.dll
Analysis ID: 1448101
MD5: 36185746a613bdc3e52906e4c053ab89
SHA1: fa0ee487b8b311d26b51cca2c83eb12441a0d4d5
SHA256: b1adadb919f6fb08fa87b4a7bae069ead20f48f3e5779d9b3b4f2e4e1ba0f189
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false
Confidence: 40%

Signatures

AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
One or more processes crash
Sample execution stops while process was sleeping (likely an evasion)

Classification

Source: pcre2-16.dll Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\DISQO-Dev\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb source: loaddll64.exe, 00000000.00000002.2879905573.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1748628092.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1771745285.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1748710356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.1754823653.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1714157625.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1717569155.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1716011101.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1719718381.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1719416153.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1720597750.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1720555307.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1719012220.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1722153325.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1720518666.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1720656916.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1722112566.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1720560199.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1721926443.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1721999203.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1719436452.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1720751694.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.1721201356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000029.00000002.1722036837.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, pcre2-16.dll
Source: Binary string: C:\DISQO-Dev\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb// source: loaddll64.exe, 00000000.00000002.2879905573.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1748628092.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1771745285.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1748710356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.1754823653.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1714157625.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1717569155.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1716011101.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1719718381.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1719416153.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1720597750.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1720555307.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1719012220.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1722153325.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1720518666.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1720656916.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1722112566.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1720560199.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1721926443.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1721999203.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1719436452.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1720751694.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.1721201356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000029.00000002.1722036837.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, pcre2-16.dll
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_1731c9291b48156d38e2b4f8fc44dc6afe3fb_76fbbc46_037511ff-28df-4739-9281-9d59950f9335\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_a85d3f61e282c6ab111541d23626a541f6483d_76fbbc46_27c8a652-5e23-4709-baa0-ace937338ba4\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue Jump to behavior
Source: Amcache.hve.8.dr String found in binary or memory: http://upx.sf.net
Detected potential crypto function
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052B8B0 0_2_00007FFE0052B8B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005240B0 0_2_00007FFE005240B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00512890 0_2_00007FFE00512890
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00541870 0_2_00007FFE00541870
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00508070 0_2_00007FFE00508070
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515922 0_2_00007FFE00515922
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051593D 0_2_00007FFE0051593D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0050F100 0_2_00007FFE0050F100
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515902 0_2_00007FFE00515902
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515912 0_2_00007FFE00515912
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005170F0 0_2_00007FFE005170F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051E8F0 0_2_00007FFE0051E8F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005170C9 0_2_00007FFE005170C9
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052A980 0_2_00007FFE0052A980
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00521960 0_2_00007FFE00521960
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00524960 0_2_00007FFE00524960
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052A170 0_2_00007FFE0052A170
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051594D 0_2_00007FFE0051594D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051B14F 0_2_00007FFE0051B14F
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052C1E0 0_2_00007FFE0052C1E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005159D5 0_2_00007FFE005159D5
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515AA2 0_2_00007FFE00515AA2
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051FAB0 0_2_00007FFE0051FAB0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515AB4 0_2_00007FFE00515AB4
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051AA7E 0_2_00007FFE0051AA7E
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00520290 0_2_00007FFE00520290
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00511292 0_2_00007FFE00511292
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051F240 0_2_00007FFE0051F240
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00519240 0_2_00007FFE00519240
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00510BBB 0_2_00007FFE00510BBB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515B8C 0_2_00007FFE00515B8C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051B38F 0_2_00007FFE0051B38F
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051DB70 0_2_00007FFE0051DB70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515B4C 0_2_00007FFE00515B4C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0050A3F0 0_2_00007FFE0050A3F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE004F3C40 0_2_00007FFE004F3C40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00526D35 0_2_00007FFE00526D35
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051AD0E 0_2_00007FFE0051AD0E
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052BCE0 0_2_00007FFE0052BCE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005214E0 0_2_00007FFE005214E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051F4C0 0_2_00007FFE0051F4C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE004FD4EA 0_2_00007FFE004FD4EA
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051DDA0 0_2_00007FFE0051DDA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00524DB0 0_2_00007FFE00524DB0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051B5B5 0_2_00007FFE0051B5B5
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0050FD80 0_2_00007FFE0050FD80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00516590 0_2_00007FFE00516590
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052ED60 0_2_00007FFE0052ED60
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051054D 0_2_00007FFE0051054D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00500D60 0_2_00007FFE00500D60
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051EE20 0_2_00007FFE0051EE20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052A610 0_2_00007FFE0052A610
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00522E10 0_2_00007FFE00522E10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052B5C0 0_2_00007FFE0052B5C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005095C0 0_2_00007FFE005095C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052C5D0 0_2_00007FFE0052C5D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005115D0 0_2_00007FFE005115D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051669E 0_2_00007FFE0051669E
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0050D6B0 0_2_00007FFE0050D6B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051667F 0_2_00007FFE0051667F
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00516687 0_2_00007FFE00516687
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00516692 0_2_00007FFE00516692
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051BE97 0_2_00007FFE0051BE97
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0053169C 0_2_00007FFE0053169C
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00518672 0_2_00007FFE00518672
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00512E75 0_2_00007FFE00512E75
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0053BF20 0_2_00007FFE0053BF20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0050BF3D 0_2_00007FFE0050BF3D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00530710 0_2_00007FFE00530710
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00506ECA 0_2_00007FFE00506ECA
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052DEC0 0_2_00007FFE0052DEC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00509FA0 0_2_00007FFE00509FA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00511FA9 0_2_00007FFE00511FA9
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00514FB0 0_2_00007FFE00514FB0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051AF9D 0_2_00007FFE0051AF9D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00517F73 0_2_00007FFE00517F73
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00528F40 0_2_00007FFE00528F40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0050BF40 0_2_00007FFE0050BF40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515747 0_2_00007FFE00515747
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00523820 0_2_00007FFE00523820
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00508830 0_2_00007FFE00508830
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051B830 0_2_00007FFE0051B830
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00515805 0_2_00007FFE00515805
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051581A 0_2_00007FFE0051581A
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0051F7E0 0_2_00007FFE0051F7E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005157F5 0_2_00007FFE005157F5
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE004FAFE8 0_2_00007FFE004FAFE8
One or more processes crash
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7336 -s 332
Source: classification engine Classification label: clean4.winDLL@108/17@0/0
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7596
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7320
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7336
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7756
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9a540079-8a23-46e2-b9c0-b272d37860c0 Jump to behavior
Source: pcre2-16.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_callout_enumerate_16
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\pcre2-16.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_callout_enumerate_16
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7336 -s 332
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7320 -s 332
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_code_copy_16
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7596 -s 324
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_code_copy_with_tables_16
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7756 -s 324
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_callout_enumerate_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_code_copy_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_code_copy_with_tables_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_number_from_name_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_nametable_scan_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_list_get_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_list_free_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_length_bynumber_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_length_byname_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_get_bynumber_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_get_byname_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_free_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_copy_bynumber_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_copy_byname_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substitute_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_substitute_callout_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_recursion_memory_management_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_recursion_limit_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_parens_nest_limit_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_offset_limit_16
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_callout_enumerate_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_code_copy_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_code_copy_with_tables_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_callout_enumerate_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_code_copy_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_code_copy_with_tables_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_number_from_name_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_nametable_scan_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_list_get_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_list_free_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_length_bynumber_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_length_byname_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_get_bynumber_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_get_byname_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_free_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_copy_bynumber_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_copy_byname_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substitute_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_substitute_callout_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_recursion_memory_management_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_recursion_limit_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_parens_nest_limit_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_offset_limit_16 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: vcruntime140.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: pcre2-16.dll Static PE information: Image base 0x180000000 > 0x60000000
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: pcre2-16.dll Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: pcre2-16.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\DISQO-Dev\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb source: loaddll64.exe, 00000000.00000002.2879905573.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1748628092.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1771745285.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1748710356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.1754823653.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1714157625.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1717569155.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1716011101.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1719718381.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1719416153.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1720597750.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1720555307.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1719012220.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1722153325.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1720518666.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1720656916.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1722112566.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1720560199.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1721926443.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1721999203.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1719436452.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1720751694.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.1721201356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000029.00000002.1722036837.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, pcre2-16.dll
Source: Binary string: C:\DISQO-Dev\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb// source: loaddll64.exe, 00000000.00000002.2879905573.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1748628092.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1771745285.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1748710356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.1754823653.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1714157625.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1717569155.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1716011101.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1719718381.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1719416153.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1720597750.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1720555307.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1719012220.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1722153325.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1720518666.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1720656916.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1722112566.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1720560199.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1721926443.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1721999203.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1719436452.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1720751694.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.1721201356.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000029.00000002.1722036837.00007FFE00552000.00000002.00000001.01000000.00000003.sdmp, pcre2-16.dll
Source: pcre2-16.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pcre2-16.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pcre2-16.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pcre2-16.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pcre2-16.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE0052B3D0 GetSystemInfo,VirtualAlloc, 0_2_00007FFE0052B3D0
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_1731c9291b48156d38e2b4f8fc44dc6afe3fb_76fbbc46_037511ff-28df-4739-9281-9d59950f9335\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_a85d3f61e282c6ab111541d23626a541f6483d_76fbbc46_27c8a652-5e23-4709-baa0-ace937338ba4\ Jump to behavior
Source: C:\Windows\System32\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue Jump to behavior
Source: Amcache.hve.8.dr Binary or memory string: VMware
Source: Amcache.hve.8.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Checks if the current process is being debugged
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005447F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FFE005447F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE00543D50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FFE00543D50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005447F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FFE005447F0
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1 Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005256B0 cpuid 0_2_00007FFE005256B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFE005443AC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FFE005443AC
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.8.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1448101 Sample: pcre2-16.dll Startdate: 27/05/2024 Architecture: WINDOWS Score: 4 7 loaddll64.exe 1 2->7         started        process3 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 22 other processes 7->15 process4 17 rundll32.exe 9->17         started        19 WerFault.exe 20 16 11->19         started        21 WerFault.exe 16 13->21         started        23 WerFault.exe 16 15->23         started        process5 25 WerFault.exe 16 17->25         started       
⊘No contacted IP infos