Windows Analysis Report
vQu0zndLpi.dll

Source: Joe Sandbox View

ASN Name: FREERANGECLOUDCA FREERANGECLOUDCA

Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_000001F8D4A83C80 recv,

9_2_000001F8D4A83C80

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36A3AF0	4_2_00007FFDA36A3AF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA363A3C0	4_2_00007FFDA363A3C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36AC360	4_2_00007FFDA36AC360
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36743E0	4_2_00007FFDA36743E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA365A320	4_2_00007FFDA365A320
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3646310	4_2_00007FFDA3646310
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36491D7	4_2_00007FFDA36491D7
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA368C190	4_2_00007FFDA368C190
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36C4248	4_2_00007FFDA36C4248
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA367B0B0	4_2_00007FFDA367B0B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3688150	4_2_00007FFDA3688150
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36830E0	4_2_00007FFDA36830E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36887C0	4_2_00007FFDA36887C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA366B7A0	4_2_00007FFDA366B7A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA367A820	4_2_00007FFDA367A820
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36237E0	4_2_00007FFDA36237E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36BE6DC	4_2_00007FFDA36BE6DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36626D0	4_2_00007FFDA36626D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36766C0	4_2_00007FFDA36766C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3639750	4_2_00007FFDA3639750
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3687700	4_2_00007FFDA3687700
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36AC5C8	4_2_00007FFDA36AC5C8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA363F5B0	4_2_00007FFDA363F5B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3653590	4_2_00007FFDA3653590
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3673600	4_2_00007FFDA3673600
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3650530	4_2_00007FFDA3650530
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36764F0	4_2_00007FFDA36764F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3665C50	4_2_00007FFDA3665C50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36B5C40	4_2_00007FFDA36B5C40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3688C00	4_2_00007FFDA3688C00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3673BE0	4_2_00007FFDA3673BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36A3BE4	4_2_00007FFDA36A3BE4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36B8A84	4_2_00007FFDA36B8A84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3646B40	4_2_00007FFDA3646B40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3638960	4_2_00007FFDA3638960
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA366DA50	4_2_00007FFDA366DA50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36BDA2C	4_2_00007FFDA36BDA2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36859F0	4_2_00007FFDA36859F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA366F9F0	4_2_00007FFDA366F9F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA367F9E0	4_2_00007FFDA367F9E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA363B890	4_2_00007FFDA363B890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA367E890	4_2_00007FFDA367E890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3668880	4_2_00007FFDA3668880
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36B7F78	4_2_00007FFDA36B7F78
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3673040	4_2_00007FFDA3673040
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36BD020	4_2_00007FFDA36BD020
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3668010	4_2_00007FFDA3668010
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36A2FF0	4_2_00007FFDA36A2FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36BFF58	4_2_00007FFDA36BFF58
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36C1D90	4_2_00007FFDA36C1D90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA36BBE08	4_2_00007FFDA36BBE08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFDA3634D30	4_2_00007FFDA3634D30
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001F8D4A8826A	9_2_000001F8D4A8826A
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001C46B8E826A	13_2_000001C46B8E826A

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\tmpf193.dll C9920E995FBC98CD3883EF4C4520300D5E82BAB5D2A5C781E9E9FE694A43E82F

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFDA36258A0 appears 187 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFDA36ADFA8 appears 176 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFDA362A750 appears 88 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFDA3629980 appears 49 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 404 -s 464

Source: vQu0zndLpi.dll

Binary or memory string: OriginalFilenamewsc.dllB" vs vQu0zndLpi.dll

Source: classification engine

Classification label: mal76.evad.winDLL@25/6@0/1

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA367A4B0 CreateToolhelp32Snapshot,GetLastError,

4_2_00007FFDA367A4B0

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA363A3C0 timeGetTime,CoCreateInstance,timeGetTime,timeGetTime,

4_2_00007FFDA363A3C0

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA363EA90 LoadResource,LockResource,SizeofResource,

4_2_00007FFDA363EA90

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess404
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\fd8585bb-bf54-4ffe-b9f9-19469cc3e4aa

Source: vQu0zndLpi.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart

Source: vQu0zndLpi.dll

ReversingLabs: Detection: 34%

Source: rundll32.exe

String found in binary or memory: /launch

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\vQu0zndLpi.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 404 -s 464
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,start
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\Temp/tmpf193.dll,run C:\Users\user\Desktop\vQu0zndLpi.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,DllWinMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",xtart
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",start
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",DllWinMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",UnInstall
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\Temp/tmpf193.dll,run C:\Users\user\Desktop\vQu0zndLpi.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,start	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,DllWinMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",xtart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",start	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",DllWinMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",UnInstall	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\Temp/tmpf193.dll,run C:\Users\user\Desktop\vQu0zndLpi.dll	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\Temp/tmpf193.dll,run C:\Users\user\Desktop\vQu0zndLpi.dll	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: vQu0zndLpi.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: vQu0zndLpi.dll

Static file information: File size 1138176 > 1048576

Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: vQu0zndLpi.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: vQu0zndLpi.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\bamboo\home\xml-data\build-dir\WSP-MASTER-SOURCES\bin\x64\Release\wsc.pdbd source: rundll32.exe, 00000004.00000002.2178255810.00007FFDA36D7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000002.2177541208.00007FFDA36D7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2246763943.00007FFDA36D7000.00000002.00000001.01000000.00000003.sdmp, vQu0zndLpi.dll
Source:	Binary string: D:\bamboo\home\xml-data\build-dir\WSP-MASTER-SOURCES\bin\x64\Release\wsc.pdb source: rundll32.exe, 00000004.00000002.2178255810.00007FFDA36D7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000002.2177541208.00007FFDA36D7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2246763943.00007FFDA36D7000.00000002.00000001.01000000.00000003.sdmp, vQu0zndLpi.dll

Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36A3E90 LoadLibraryA,GetProcAddressForCaller,

4_2_00007FFDA36A3E90

Source: vQu0zndLpi.dll	Static PE information: real checksum: 0x11082c should be: 0x11773c
Source: tmpf193.dll.9.dr	Static PE information: real checksum: 0x7024 should be: 0x7b45

Source: vQu0zndLpi.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\tmpf193.dll

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA3678440 FreeLibrary,FreeLibrary,GetModuleHandleExW,FreeLibrary,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FFDA3678440

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 14400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 32400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 57600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90000000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 14400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 32400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 57600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90000000	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpf193.dll

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

API coverage: 0.7 %

Source: C:\Windows\System32\loaddll64.exe TID: 4416	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3700	Thread sleep time: -3300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3700	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3700	Thread sleep time: -14400000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3700	Thread sleep time: -32400000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3700	Thread sleep time: -57600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3700	Thread sleep time: -90000000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5920	Thread sleep time: -3300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5920	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5920	Thread sleep time: -14400000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5920	Thread sleep time: -32400000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5920	Thread sleep time: -57600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5920	Thread sleep time: -90000000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 14400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 32400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 57600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90000000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 14400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 32400000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 57600000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 90000000	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: rundll32.exe, 00000009.00000002.2176752182.000001F8D486F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe, 0000000D.00000002.2246588873.000001C46A028000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllii
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36A0B94 GetLastError,IsDebuggerPresent,OutputDebugStringW,

4_2_00007FFDA36A0B94

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36A0B94 GetLastError,IsDebuggerPresent,OutputDebugStringW,

4_2_00007FFDA36A0B94

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36A3E90 LoadLibraryA,GetProcAddressForCaller,

4_2_00007FFDA36A3E90

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA3621C00 GetProcessHeap,

4_2_00007FFDA3621C00

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36A9A28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FFDA36A9A28

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\rundll32.exe

Network Connect: 45.66.248.99 443

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA3676C20 SetEntriesInAclW,LocalFree,LocalAlloc,LocalFree,GetLastError,LocalFree,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,

4_2_00007FFDA3676C20

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36763B0 AllocateAndInitializeSid,GetLastError,

4_2_00007FFDA36763B0

Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FFDA36CA388
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FFDA36CA458
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FFDA36C06B8
Source: C:\Windows\System32\rundll32.exe	Code function: try_get_function,GetLocaleInfoW,	4_2_00007FFDA36C0C4C
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00007FFDA36CAA74
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00007FFDA36CA898
Source: C:\Windows\System32\rundll32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_00007FFDA36CA038

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFDA36A2FA8 GetSystemTimeAsFileTime,

4_2_00007FFDA36A2FA8

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vQu0zndLpi.dll	34%	ReversingLabs	Win64.Downloader.ZLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\tmpf193.dll	100%	Avira	TR/AVI.Agent.yfqhy
C:\Users\user\AppData\Local\Temp\tmpf193.dll	83%	ReversingLabs	Win64.Trojan.Interlock

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.66.248.99	unknown	Russian Federation		53356	FREERANGECLOUDCA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572522
Start date and time:	2024-12-10 16:44:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vQu0zndLpi.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	bef34611564f850070ab13288c6d52de24fbcfc2ede9323eb675d32a31413f18.dll.exe
Detection:	MAL
Classification:	mal76.evad.winDLL@25/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 221

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 40.126.32.136, 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: vQu0zndLpi.dll

Simulations

Behavior and APIs

Time	Type	Description
10:45:05	API Interceptor	34x Sleep call for process: rundll32.exe modified
10:45:08	API Interceptor	1x Sleep call for process: WerFault.exe modified
10:45:11	API Interceptor	1x Sleep call for process: loaddll64.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREERANGECLOUDCA	jklarm5.elf	Get hash	malicious	Unknown	Browse	216.24.208.32
	Jaws.exe	Get hash	malicious	Stealc	Browse	45.66.248.237
	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse	45.66.249.162
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.129.35.4
	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59
	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	193.142.147.59
	http://www.brookskushman.com	Get hash	malicious	Unknown	Browse	45.66.248.122

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\tmpf193.dll	lK1DKi27B4.dll	Get hash	malicious	Unknown	Browse
	7ffbfc130000.conhost2.dll.dll	Get hash	malicious	Unknown	Browse
	nPyo7vtpRl.dll	Get hash	malicious	Unknown	Browse
	rdl3kBqbTy.dll	Get hash	malicious	Unknown	Browse
	nPyo7vtpRl.dll	Get hash	malicious	Unknown	Browse
	rdl3kBqbTy.dll	Get hash	malicious	Unknown	Browse
	7ff6c1d70000.xxtlz.exe	Get hash	malicious	Unknown	Browse
	VOqg4bXfFS.dll	Get hash	malicious	Unknown	Browse
	tZlDJKdfV6.dll	Get hash	malicious	Unknown	Browse
	Y1kJT9dEK1.dll	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vQu_bf88271f391678879aeb028db498ef27a519745_bcdf938d_146b9252-3f35-4b96-9696-2b8d3c7bcce4\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8165978015413434
Encrypted:	false
SSDEEP:	96:AMFnF6Fi9yKynsj6s4RvFm+qlf1BQXIDcQLc6wcEicw3MXaXz+HbHgSQgJj27h83:RNKi9ynuu0l04mjOvzuiF1Z24lO8g/3
MD5:	6C14B4FE0A89E3150641D45F22FDACE9
SHA1:	66F34C9A841DEF3A8D2315D82720C0149602832E
SHA-256:	420155904420D64B2DD8D890CE5E66C0519C88802D5806CD8DACE17E93C090CE
SHA-512:	E65C50E6DEEEF47154758FD066481CF601B97D20006205FF26642FF239B31B688BE5AAEE6C0CE6C8E97F9AFD0787141836DD7A24173BCFCA2E117C648AA35BDF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.3.1.9.1.0.2.8.9.6.5.6.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.3.1.9.1.0.3.5.9.9.6.9.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.6.b.9.2.5.2.-.3.f.3.5.-.4.b.9.6.-.9.6.9.6.-.2.b.8.d.3.c.7.b.c.c.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.5.9.d.6.c.3.-.3.3.b.0.-.4.e.9.9.-.b.8.c.4.-.8.c.c.d.5.f.e.e.a.6.0.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.v.Q.u.0.z.n.d.L.p.i...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.9.4.-.0.0.0.1.-.0.0.1.5.-.f.4.3.3.-.d.b.7.9.1.a.4.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3DB.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 10 15:45:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	567610
Entropy (8bit):	1.4623863133537793
Encrypted:	false
SSDEEP:	384:X/4RqW1lIYPP33qYhSkcfIBc5bgEIscmPiC/h7oRZ33sur3S8Ff0N2EdzDxo6V:yq+P33DhSkcfXDiOh7oRZ33so3KxzC6V
MD5:	CE44B5F6E0D7197C002BA8B6CA6688AE
SHA1:	54D8908928A5A9D1EF5823CD9A06007305ED657A
SHA-256:	E66C540713F1A90A81AC0A716E074DAF442852C6E8DF952D4F48F6B7F763DDC4
SHA-512:	4706EC3795C94FD0C28BB47A7CDB40C5E7A93846631B8EFF40AECD22BC2044C8DFE67E28EFCFA045233A39A1A2AB9DE54C5B0D16AF7AE388388CD61DDC0B460E
Malicious:	false
Preview:	MDMP..a..... ........aXg........................................X-..........T.......8...........T...........X..............H...........4...............................................................................eJ..............Lw......................T............aXg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF563.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8718
Entropy (8bit):	3.7044200649980454
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2Mhu8a6YXru0gmfp9npD089bKtkfqum:R6lXJT26Yb1gmfp9TKOfa
MD5:	511390FE73F08A721D8EE4785721220A
SHA1:	38576A63AA3083939C98EFCE6DC4E8D176D9B80B
SHA-256:	B7DAF0E1614307C8AA60247DC7C95B32BEDE2CF5DEE5105CCEDE490DF4C0EA3C
SHA-512:	65D74C2110863F64E5A9ED70689A8B57CB74D8B86E357F1A81F71C088B449F6C0BA99A5AFFEBAE3F01B0BEFB6E11C2EECE290F486EE829928D38DDABA74C024D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.4.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF583.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4759
Entropy (8bit):	4.4863842114209485
Encrypted:	false
SSDEEP:	48:cvIwWl8zs9Jg771I9mCcWpW8VYjnYm8M4JCY9CY1+AK6Fgmyq85mYgAsxKxptSTz:uIjfXI7oV7VTJ7Vf2mSzRpoOud
MD5:	944C30509588E500A104DF50F6A108FC
SHA1:	49585B651B68AB9F65888AF1338C650509B55F5F
SHA-256:	B6C143DA5EEE98D88509C1C84D83DC98A919B8487D39D2D0D133F9F61BF61967
SHA-512:	F254EB4DEDB4D7FEE9DC4EB98E1C45D25BA51ED9F1B59DCFD9687071C6BA8D09A8AE0A1BB711F4D390D5D96A0F31A99518BAC01433E8EDD92F9E3D7077A8030F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="625367" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\tmpf193.dll

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.257085001705468
Encrypted:	false
SSDEEP:	12:etGSGQwU8O0ay2Y8qS6gK/H/ffk6Om2BXp:etGScU8O0ay2vqS6p/H/QvBXp
MD5:	634A9AF8D3F2FA0D38820D577FB0FBEB
SHA1:	CD6E84A3C4F81FC9DF8B82449DB8B2E87130E3FD
SHA-256:	C9920E995FBC98CD3883EF4C4520300D5E82BAB5D2A5C781E9E9FE694A43E82F
SHA-512:	ABCA2E016FF5A53395F95BA75C96F5BFA102086E92A8E2647BD2584A75E4A81A59596848D1ABFAB8E37981A6ADB021A35074D4DC99868CC30C9C4E2A4666C50A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: lK1DKi27B4.dll, Detection: malicious, Browse Filename: 7ffbfc130000.conhost2.dll.dll, Detection: malicious, Browse Filename: nPyo7vtpRl.dll, Detection: malicious, Browse Filename: rdl3kBqbTy.dll, Detection: malicious, Browse Filename: nPyo7vtpRl.dll, Detection: malicious, Browse Filename: rdl3kBqbTy.dll, Detection: malicious, Browse Filename: 7ff6c1d70000.xxtlz.exe, Detection: malicious, Browse Filename: VOqg4bXfFS.dll, Detection: malicious, Browse Filename: tZlDJKdfV6.dll, Detection: malicious, Browse Filename: Y1kJT9dEK1.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....f....r.....&"...(.....................................................@......$p....`... ...................................... ..?....0......................................................................................`0.. ............................text...p........................... ..`.edata..?.... ......................@..@.idata.......0......................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469500637909571
Encrypted:	false
SSDEEP:	6144:7zZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNMjDH5S:3ZHtYZWOKnMM6bFpaj4
MD5:	E33C6FCA5C006424C2D8E78B7D6F5CA9
SHA1:	273A08ABD6FCE8B0A9278C0EF5E7427F934EFD91
SHA-256:	80888B56AB46A9784D1713C58B51C58BE2E1785B616EAA4F585CCB05860DBAC8
SHA-512:	3C498277F40E3876500B52ACD7CAC5AD7E8CBD74BB92A67BE3C347CDCFC39FF84C3EDD086F9464FE02404B0149DE593D9BB208544AFE649F984D0F2E0D7204A1
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..$z.K................................................................................................................................................................................................................................................................................................................................................2N........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.476113305296515
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	vQu0zndLpi.dll
File size:	1'138'176 bytes
MD5:	6b0b96b6ec7950943213da4f98fab1c7
SHA1:	502b8b7c5888b476365345d029df4f1d80c381c2
SHA256:	bef34611564f850070ab13288c6d52de24fbcfc2ede9323eb675d32a31413f18
SHA512:	f80bbffc22aa041eb1ccbb39f390fd322ab2b701b30d83e6872b68bc85b8c645d076b7216c5da6eab159fc9074bfc2c8410db6a6ce2e1c658868086dc88c6951
SSDEEP:	24576:D+XUNkTrLLAhpLJdqhQZE8cpKPpo1MsAVHB+FYiY25r3wai:iXUNuAhpXqa+8cpKBgZAZBvig
TLSH:	7C356B1767F805A8E8B6D178897B5806F736B41587309AEF02D0226B1F77BE08E7E711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.........................5...............................................................a...J.......J.......J..............

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180083a90
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x66FA53D2 [Mon Sep 30 07:31:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	767132e147d9da374bf0eb60457b20e1

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
cmp edx, 01h
jne 00007F2D84C83106h
dec eax
mov edx, ecx
dec eax
add edx, 001013B8h
call 00007F2D84C8313Dh
dec sp
movd mm5, eax
mov eax, 00000001h
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
dec sp
movd eax, mm5
dec eax
add esp, 28h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F2D84C830D3h
mov edx, 00001BD8h
dec eax
mov ecx, eax
call 00007F2D84C837AFh
call eax
xor eax, eax
dec eax
add esp, 28h
ret
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+08h], ecx
push ebp
push esi
push edi
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
dec eax
lea ebp, dword ptr [esp-27h]
dec eax
sub esp, 00000100h
inc ebp
xor esp, esp
dec eax
mov ebx, edx
mov dword ptr [esp+20h], 4C682648h
mov dword ptr [esp+24h], 436D2A5Fh
mov dword ptr [esp+28h], 4F4D674Fh
mov dword ptr [esp+2Ch], 75352979h
inc sp
mov dword ptr [esp+50h], esp
mov byte ptr [esp+30h], 00000000h
mov dword ptr [esp+38h], 0065006Bh
mov dword ptr [esp+3Ch], 006E0072h
mov dword ptr [esp+40h], 00000065h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xede80	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xedf0c	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x101000	0x196ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf8000	0x744c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xfcc00	0x4dc8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11b000	0x156c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd9330	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9500	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xd93a0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb7000	0x5f8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb572c	0xb5800	fc6ea9a56a230231c4bb1fdc5ef08421	False	0.4668183970385675	data	6.386830917577598	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb7000	0x383b6	0x38400	ec611e4019790695ac7d6d148ac88116	False	0.3645833333333333	data	4.902790895501739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf0000	0x749c	0x5800	68b698e4c7307e6be67b30c865614f37	False	0.15185546875	data	4.497462253406015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf8000	0x744c	0x7600	27d6cbc5cf6ad3575f8a0f04a40429a3	False	0.4889433262711864	PEX Binary Archive	5.836748779718831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x100000	0xf4	0x200	3becaaa5faf69c9c92c0abf64cce14d9	False	0.3046875	data	2.4434385797190123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x101000	0x196ec	0x19800	a2add8433692a7f4ef3e303d8b906d10	False	0.5730602787990197	data	7.1419435849845465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11b000	0x156c	0x1600	94db310f1ca40a2e184b4684ec88d3df	False	0.37659801136363635	data	5.401573591665021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1010e8	0x2d0	data	English	United States	0.46805555555555556
RT_ANICURSOR	0x1013b8	0x191b2	data			0.5751210689071707
RT_MANIFEST	0x11a56c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
RPCRT4.dll	UuidToStringW, UuidCreate, RpcStringFreeW
KERNEL32.dll	LoadLibraryExW, SizeofResource, LockResource, LoadResource, FindResourceExW, FindResourceW, EnterCriticalSection, ReleaseSemaphore, LeaveCriticalSection, InitializeCriticalSection, WaitForThreadpoolTimerCallbacks, GetCurrentThreadId, CloseThreadpoolWait, WaitForThreadpoolWaitCallbacks, CloseThreadpoolTimer, CloseHandle, SetThreadpoolTimer, SetThreadpoolWait, CreateSemaphoreW, MultiByteToWideChar, GetModuleHandleW, WideCharToMultiByte, LocalFree, DeleteCriticalSection, GetCurrentProcessId, CreateFileW, GetFileTime, FileTimeToSystemTime, GetSystemTime, CreateProcessW, DeleteProcThreadAttributeList, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, GetExitCodeProcess, CreateThreadpoolWait, CreateThreadpoolTimer, CreateEventW, ResetEvent, LocalAlloc, CreateThread, OpenProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, WriteConsoleW, FreeEnvironmentStringsW, GetEnvironmentStringsW, DecodePointer, RaiseException, InitializeCriticalSectionEx, WaitForSingleObject, SetEvent, GetLastError, VerSetConditionMask, VerifyVersionInfoW, GetModuleHandleExW, Sleep, GetProcAddress, LoadLibraryW, GetModuleFileNameW, FreeLibrary, GetProcessHeap, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, FormatMessageA, SetStdHandle, ExitProcess, GetCommandLineW, RtlUnwind, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, ReadConsoleW, GetConsoleMode, GetConsoleOutputCP, WriteFile, GetFileType, GetStdHandle, ReadFile, SetConsoleCtrlHandler, FreeLibraryAndExitThread, ExitThread, FlushFileBuffers, GetFileSizeEx, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, TlsFree, LCMapStringW, IsDebuggerPresent, OutputDebugStringW, GetStringTypeW, WaitForSingleObjectEx, GetExitCodeThread, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryEnterCriticalSection, FindClose, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, SetEndOfFile, SetFilePointerEx, GetFileInformationByHandleEx, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetCPInfo, InitializeCriticalSectionAndSpinCount, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, InterlockedFlushSList, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue
USER32.dll	AllowSetForegroundWindow
ADVAPI32.dll	RevertToSelf, ImpersonateLoggedOnUser, OpenProcessToken, QueryServiceStatusEx, OpenSCManagerW, OpenServiceW, GetSecurityInfo, GetSidIdentifierAuthority, GetAce, GetSidSubAuthority, GetSidSubAuthorityCount, EqualSid, ConvertSidToStringSidW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclW, RegDeleteKeyW, FreeSid, CheckTokenMembership, AllocateAndInitializeSid, CloseServiceHandle, RegSetKeyValueW, RegOpenKeyExW, RegGetValueW, RegCloseKey
SHELL32.dll	CommandLineToArgvW, SHGetKnownFolderPath
ole32.dll	CoInitializeEx, CoUninitialize, CoSetProxyBlanket, CoTaskMemFree, CoCreateInstance
OLEAUT32.dll	SysAllocString, VariantClear, SafeArrayCreate, VariantInit, SysStringLen, SysAllocStringLen, SysFreeString
SHLWAPI.dll	PathRemoveFileSpecW, PathAppendW, PathIsRelativeW
WINMM.dll	timeGetTime
ntdll.dll	RtlLookupFunctionEntry, RtlVirtualUnwind, RtlCaptureContext

Exports

Name	Ordinal	Address
xtart	1	0x180020ad0
start	2	0x180020b00
DllWinMain	4	0x18005b0b0
UnInstall	3	0x18006cfe0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:45:05.840579033 CET	49708	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:05.840605021 CET	443	49708	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:05.842237949 CET	49708	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:05.844288111 CET	49708	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:05.844301939 CET	443	49708	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:05.844369888 CET	443	49708	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:05.949861050 CET	49709	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:05.949893951 CET	443	49709	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:05.950032949 CET	49709	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:05.951869965 CET	49709	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:05.951881886 CET	443	49709	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:05.951931953 CET	443	49709	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.059345007 CET	49710	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.059364080 CET	443	49710	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.059459925 CET	49710	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.060062885 CET	49710	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.060072899 CET	443	49710	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.060147047 CET	443	49710	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.168692112 CET	49711	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.168724060 CET	443	49711	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.170380116 CET	49711	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.171083927 CET	49711	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.171097994 CET	443	49711	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.171155930 CET	443	49711	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.278052092 CET	49712	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.278088093 CET	443	49712	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.278283119 CET	49712	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.278942108 CET	49712	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.278956890 CET	443	49712	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.279017925 CET	443	49712	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.387310028 CET	49714	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.387334108 CET	443	49714	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.390507936 CET	49714	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.391201019 CET	49714	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.391211987 CET	443	49714	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.391274929 CET	443	49714	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.496895075 CET	49715	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.496997118 CET	443	49715	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.497116089 CET	49715	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.497711897 CET	49715	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.497725010 CET	443	49715	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.497767925 CET	443	49715	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.607490063 CET	49716	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.607517958 CET	443	49716	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.607594967 CET	49716	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.609503031 CET	49716	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.609517097 CET	443	49716	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.609554052 CET	443	49716	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.716022968 CET	49717	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.716044903 CET	443	49717	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.716114044 CET	49717	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.716697931 CET	49717	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.716717958 CET	443	49717	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.716751099 CET	443	49717	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.827663898 CET	49718	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.827696085 CET	443	49718	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.827775955 CET	49718	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.828356981 CET	49718	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.828372002 CET	443	49718	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.828416109 CET	443	49718	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.935189962 CET	49720	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.935213089 CET	443	49720	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.935333014 CET	49720	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.935902119 CET	49720	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:06.935914993 CET	443	49720	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:06.935969114 CET	443	49720	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.067049980 CET	49721	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.067090988 CET	443	49721	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.067150116 CET	49721	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.080480099 CET	49721	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.080496073 CET	443	49721	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.080540895 CET	443	49721	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.185355902 CET	49723	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.185395956 CET	443	49723	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.185477018 CET	49723	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.346136093 CET	49723	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.346153975 CET	443	49723	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.346215963 CET	443	49723	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.450315952 CET	49724	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.450340986 CET	443	49724	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.450395107 CET	49724	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.453311920 CET	49724	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.453330994 CET	443	49724	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.453366041 CET	443	49724	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.559309959 CET	49725	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.559356928 CET	443	49725	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.559439898 CET	49725	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.560143948 CET	49725	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.560162067 CET	443	49725	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.560199976 CET	443	49725	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.668941021 CET	49726	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.668998003 CET	443	49726	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.669071913 CET	49726	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.670099974 CET	49726	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:07.670121908 CET	443	49726	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:07.670166016 CET	443	49726	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:12.809901953 CET	49729	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:12.809925079 CET	443	49729	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:12.810008049 CET	49729	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.032089949 CET	49729	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.032105923 CET	443	49729	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.032175064 CET	443	49729	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.137530088 CET	49730	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.137579918 CET	443	49730	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.137641907 CET	49730	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.139944077 CET	49730	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.139955044 CET	443	49730	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.140018940 CET	443	49730	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.255021095 CET	49731	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.255038977 CET	443	49731	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.255109072 CET	49731	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.257989883 CET	49731	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.258002043 CET	443	49731	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.258048058 CET	443	49731	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.371676922 CET	49737	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.371712923 CET	443	49737	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.371779919 CET	49737	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.372493029 CET	49737	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.372508049 CET	443	49737	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.372556925 CET	443	49737	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.481081963 CET	49738	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.481112003 CET	443	49738	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.481184006 CET	49738	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.482014894 CET	49738	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.482028008 CET	443	49738	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.482057095 CET	443	49738	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.590694904 CET	49739	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.590727091 CET	443	49739	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.590792894 CET	49739	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.591396093 CET	49739	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.591408014 CET	443	49739	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.591445923 CET	443	49739	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.699862003 CET	49740	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.699892998 CET	443	49740	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.699970961 CET	49740	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.700588942 CET	49740	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.700599909 CET	443	49740	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.700628042 CET	443	49740	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.809340000 CET	49741	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.809375048 CET	443	49741	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.809493065 CET	49741	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.810180902 CET	49741	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.810194016 CET	443	49741	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.810214996 CET	443	49741	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.918675900 CET	49742	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.918740034 CET	443	49742	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.918808937 CET	49742	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.919441938 CET	49742	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:13.919451952 CET	443	49742	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:13.919477940 CET	443	49742	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.027982950 CET	49743	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.028007984 CET	443	49743	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.028175116 CET	49743	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.029016972 CET	49743	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.029030085 CET	443	49743	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.029077053 CET	443	49743	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.137492895 CET	49744	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.137531042 CET	443	49744	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.137617111 CET	49744	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.138408899 CET	49744	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.138422966 CET	443	49744	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.138469934 CET	443	49744	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.247046947 CET	49745	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.247081041 CET	443	49745	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.247189999 CET	49745	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.247936964 CET	49745	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.247951984 CET	443	49745	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.248003960 CET	443	49745	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.356344938 CET	49746	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.356363058 CET	443	49746	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.356434107 CET	49746	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.357095957 CET	49746	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.357105970 CET	443	49746	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.357136965 CET	443	49746	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.465466976 CET	49747	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.465504885 CET	443	49747	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.465583086 CET	49747	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.466310978 CET	49747	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.466325045 CET	443	49747	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.466366053 CET	443	49747	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.574966908 CET	49748	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.575002909 CET	443	49748	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.575141907 CET	49748	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.576491117 CET	49748	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.576504946 CET	443	49748	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.576543093 CET	443	49748	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.684241056 CET	49749	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.684298992 CET	443	49749	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.684384108 CET	49749	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.685108900 CET	49749	443	192.168.2.6	45.66.248.99
Dec 10, 2024 16:45:14.685125113 CET	443	49749	45.66.248.99	192.168.2.6
Dec 10, 2024 16:45:14.685170889 CET	443	49749	45.66.248.99	192.168.2.6

Target ID:	0
Start time:	10:45:02
Start date:	10/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\vQu0zndLpi.dll"
Imagebase:	0x7ff66eb60000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	10:45:02
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	10:45:02
Start date:	10/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Imagebase:	0x7ff7755b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:45:02
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:45:02
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	10:45:02
Start date:	10/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 404 -s 464
Imagebase:	0x7ff6def20000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	10:45:05
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,start
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	10:45:07
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\AppData\Local\Temp/tmpf193.dll,run C:\Users\user\Desktop\vQu0zndLpi.dll
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	10:45:08
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,DllWinMain
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	10:45:11
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",xtart
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	10:45:11
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",start
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	10:45:11
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",DllWinMain
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	10:45:11
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",UnInstall
Imagebase:	0x7ff7429d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true