Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
tTdMHr6SlJ.dll

Overview

General Information

Sample name:tTdMHr6SlJ.dll
renamed because original name is a hash value
Original sample name:40c708f5f85591eab36738ba4df9c46b296bd417bec2c4f5fabfc27b7b5fb317.dll
Analysis ID:1578838
MD5:b580bfbbff6e7e9e3cc6d04c397a6d68
SHA1:0464dabfcf01bff7ec7696c844c2d47f95a2a154
SHA256:40c708f5f85591eab36738ba4df9c46b296bd417bec2c4f5fabfc27b7b5fb317
Tags:bankerdlllatamPAGAMENTOS-DIGITAIS-LTDAtrojanuser-johnk3r
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication

Classification

  • System is w10x64
  • loaddll32.exe (PID: 6624 cmdline: loaddll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)
    • conhost.exe (PID: 6644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6768 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • rundll32.exe (PID: 6840 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)
        • WerFault.exe (PID: 7080 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 776 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • rundll32.exe (PID: 6820 cmdline: rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x000025F0 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 4504 cmdline: rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00060E00 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 4592 cmdline: rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00077A00 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 4048 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x000025F0 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 5728 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00060E00 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 1860 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00077A00 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7012 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)
      • WerFault.exe (PID: 984 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 768 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • rundll32.exe (PID: 6388 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 6988 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write_noraise MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 3156 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7092 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_uop_symbols_test MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7116 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_union_type_or MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7132 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex_bytes_with_sep MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7112 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 5460 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_stat MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 2892 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable_async_safe MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 4956 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 3368 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open_noraise MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 1376 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 3748 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_normpath MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 6288 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_steal MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 1360 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_size MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7176 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_set MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7184 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new_full MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7192 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7200 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_len MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7208 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_hash_ptr MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7216 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_get MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7224 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_foreach MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7240 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_destroy MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7248 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_compare_direct MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7256 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_clear MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7264 cmdline: rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_get_osfhandle MD5: 889B99C52A60DD49227C5E485A016679)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: tTdMHr6SlJ.dllAvira: detected
Source: tTdMHr6SlJ.dllReversingLabs: Detection: 47%
Source: tTdMHr6SlJ.dllVirustotal: Detection: 32%Perma Link
Source: tTdMHr6SlJ.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
Source: tTdMHr6SlJ.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT

Networking

barindex
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 23.94.207.151 80Jump to behavior
Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: global trafficHTTP traffic detected: POST /avs_coin/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 135Host: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownTCP traffic detected without corresponding DNS query: 23.94.207.151
Source: unknownHTTP traffic detected: POST /avs_coin/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 135Host: 23.94.207.151
Source: rundll32.exe, rundll32.exe, 0000000D.00000002.2052154245.0000000004920000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.2075928811.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000003.1856991121.0000000004340000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1866446970.0000000004200000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1869053027.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000003.1864396684.0000000003450000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.1906314020.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000003.1894846483.0000000004850000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1906723791.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1895673360.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1906239528.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000003.1869092136.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.1909430199.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000003.1869056770.0000000004930000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000018.00000003.1875062658.0000000004B30000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000018.00000002.1908360142.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1914107656.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000003.1901199129.0000000004980000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.1875376440.00000000043B0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.1905254203.000000006B1FB000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.indyproject.org/
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 776
Source: tTdMHr6SlJ.dllStatic PE information: invalid certificate
Source: tTdMHr6SlJ.dllStatic PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: tTdMHr6SlJ.dllStatic PE information: Resource name: RT_RCDATA type: COM executable for DOS
Source: tTdMHr6SlJ.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
Source: classification engineClassification label: mal64.evad.winDLL@88/9@0/1
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Roaming\3E5794BDJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6644:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7012
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\3E5794BD2024
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6840
Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\d776d82b-4aac-4619-a94e-47641060fa0bJump to behavior
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x000025F0
Source: tTdMHr6SlJ.dllReversingLabs: Detection: 47%
Source: tTdMHr6SlJ.dllVirustotal: Detection: 32%
Source: rundll32.exeString found in binary or memory: NATS-DANO-ADD
Source: rundll32.exeString found in binary or memory: NATS-SEFI-ADD
Source: rundll32.exeString found in binary or memory: JIS_C6229-1984-hand-add
Source: rundll32.exeString found in binary or memory: jp-ocr-hand-add
Source: rundll32.exeString found in binary or memory: jp-ocr-b-add
Source: rundll32.exeString found in binary or memory: JIS_C6229-1984-b-add
Source: rundll32.exeString found in binary or memory: ISO_6937-2-add
Source: rundll32.exeString found in binary or memory: NATS-DANO-ADD
Source: rundll32.exeString found in binary or memory: NATS-SEFI-ADD
Source: rundll32.exeString found in binary or memory: JIS_C6229-1984-hand-add
Source: rundll32.exeString found in binary or memory: jp-ocr-hand-add
Source: rundll32.exeString found in binary or memory: jp-ocr-b-add
Source: rundll32.exeString found in binary or memory: JIS_C6229-1984-b-add
Source: rundll32.exeString found in binary or memory: ISO_6937-2-add
Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll"
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x000025F0
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 776
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00060E00
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00077A00
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x000025F0
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00060E00
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00077A00
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write_noraise
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_uop_symbols_test
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_union_type_or
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 768
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex_bytes_with_sep
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_stat
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable_async_safe
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open_noraise
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_normpath
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_steal
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_size
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_set
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new_full
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_len
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_hash_ptr
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_get
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_foreach
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_destroy
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_compare_direct
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_clear
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_get_osfhandle
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x000025F0Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00060E00Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00077A00Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x000025F0Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00060E00Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00077A00Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",dbkFCallWrapperAddrJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",__dbk_fcall_wrapperJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write_noraiseJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_writeJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_uop_symbols_testJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_union_type_orJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex_bytes_with_sepJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhexJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_statJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable_async_safeJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritableJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open_noraiseJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_openJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_normpathJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_stealJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_sizeJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_setJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new_fullJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_newJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_lenJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_hash_ptrJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_getJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_foreachJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_destroyJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_compare_directJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_clearJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_get_osfhandleJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: magnification.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: d3d9.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: security.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: olepro32.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeWindow found: window name: TEditJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: tTdMHr6SlJ.dllStatic file information: File size 5321824 > 1048576
Source: tTdMHr6SlJ.dllStatic PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x4edc00
Source: tTdMHr6SlJ.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7360Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7236Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 23.94.207.151 80Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation
1
DLL Side-Loading
111
Process Injection
1
Masquerading
OS Credential Dumping2
Security Software Discovery
Remote ServicesData from Local System1
Non-Application Layer Protocol
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter
Boot or Logon Initialization Scripts1
DLL Side-Loading
2
Virtualization/Sandbox Evasion
LSASS Memory2
Virtualization/Sandbox Evasion
Remote Desktop ProtocolData from Removable Media11
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)111
Process Injection
Security Account Manager11
System Information Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Rundll32
LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Software Packing
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading
DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1578838 Sample: tTdMHr6SlJ.dll Startdate: 20/12/2024 Architecture: WINDOWS Score: 64 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 1 8->10         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 32 other processes 8->18 dnsIp5 26 23.94.207.151, 49738, 80 AS-COLOCROSSINGUS United States 10->26 32 System process connects to network (likely due to code injection or exploit) 10->32 20 rundll32.exe 14->20         started        22 WerFault.exe 16->22         started        signatures6 process7 process8 24 WerFault.exe 22 16 20->24         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
tTdMHr6SlJ.dll47%ReversingLabsWin32.Trojan.Generic
tTdMHr6SlJ.dll32%VirustotalBrowse
tTdMHr6SlJ.dll100%AviraTR/Spy.Banker.Gen
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://www.indyproject.org/rundll32.exe, rundll32.exe, 0000000D.00000002.2052154245.0000000004920000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.2075928811.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000003.1856991121.0000000004340000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1866446970.0000000004200000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1869053027.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000003.1864396684.0000000003450000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.1906314020.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000003.1894846483.0000000004850000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1906723791.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1895673360.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1906239528.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000003.1869092136.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.1909430199.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000003.1869056770.0000000004930000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000018.00000003.1875062658.0000000004B30000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000018.00000002.1908360142.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1914107656.000000006B1FB000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000003.1901199129.0000000004980000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.1875376440.00000000043B0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.1905254203.000000006B1FB000.00000040.00000001.01000000.00000003.sdmpfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    23.94.207.151
    unknownUnited States
    36352AS-COLOCROSSINGUStrue
    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1578838
    Start date and time:2024-12-20 15:26:13 +01:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 9m 21s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:42
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:tTdMHr6SlJ.dll
    renamed because original name is a hash value
    Original Sample Name:40c708f5f85591eab36738ba4df9c46b296bd417bec2c4f5fabfc27b7b5fb317.dll
    Detection:MAL
    Classification:mal64.evad.winDLL@88/9@0/1
    EGA Information:Failed
    HCA Information:Failed
    Cookbook Comments:
    • Found application associated with file extension: .dll
    • Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 104.208.16.94, 20.190.147.1, 4.175.87.197, 13.107.246.63
    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
    • Not all processes where analyzed, report is missing behavior information
    • Report size exceeded maximum capacity and may have missing behavior information.
    • Report size getting too big, too many NtOpenKeyEx calls found.
    • Report size getting too big, too many NtProtectVirtualMemory calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    TimeTypeDescription
    09:27:31API Interceptor2514x Sleep call for process: rundll32.exe modified
    09:27:43API Interceptor2x Sleep call for process: WerFault.exe modified
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    23.94.207.151e5mIhMkcj5.exeGet hashmaliciousUnknownBrowse
    • 23.94.207.151/avs_pro/index.php
    No context
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    AS-COLOCROSSINGUSe5mIhMkcj5.exeGet hashmaliciousUnknownBrowse
    • 23.94.207.151
    arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
    • 107.174.209.17
    uctgkfb7.exeGet hashmaliciousXWormBrowse
    • 192.210.175.202
    file.exeGet hashmaliciousRemcosBrowse
    • 107.173.4.16
    SwiftCopy_PaymtRecpt121228.exeGet hashmaliciousRemcosBrowse
    • 192.210.150.17
    Document.xlaGet hashmaliciousUnknownBrowse
    • 172.245.123.12
    greatnicefeatureswithsupercodebnaturalthingsinlineforgiven.htaGet hashmaliciousCobalt Strike, RemcosBrowse
    • 23.95.235.29
    sweetnesswithgreatnessiwthbestthingswithmebackickmegreatthings.htaGet hashmaliciousCobalt Strike, RemcosBrowse
    • 23.95.235.29
    createdbetterthingswithgreatnressgivenmebackwithnice.htaGet hashmaliciousCobalt Strike, FormBookBrowse
    • 172.245.123.12
    ORDER-24171200967.XLS..jsGet hashmaliciousWSHRat, Caesium Obfuscator, STRRATBrowse
    • 192.3.220.6
    No context
    No context
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):65536
    Entropy (8bit):0.9909797341397978
    Encrypted:false
    SSDEEP:192:baqiOVO6I0BU/wjeTRhZrtctzuiF9Z24IO8dci:Tit6jBU/wjeQzuiF9Y4IO8dci
    MD5:CA76BDBAD757F0DD1767D2794ED1E566
    SHA1:AFCC0DE2E866564D32FCBA9CD8883EE961613A6A
    SHA-256:FCEC896390A9F7327EA89BEBFD77AE7DF230773599BBD8002EC3EE6C943A4B9E
    SHA-512:D22ECCCAE87C514ECF75BCBF81E603789D37D591CA4CDB8853A11D609800623628CEAF3289E0520AD1266901C1B6A6DD2F9F86DB2B0E892C549CF58086C6BBE1
    Malicious:false
    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.7.8.4.3.5.8.8.2.6.7.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.7.8.4.3.8.6.3.2.6.5.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.5.d.3.2.1.3.c.-.e.7.c.c.-.4.1.d.2.-.8.a.c.d.-.f.a.8.0.f.2.3.d.e.f.1.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.5.5.b.8.3.6.-.1.c.5.6.-.4.9.8.c.-.a.8.4.0.-.b.4.c.7.a.c.3.7.9.9.5.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.b.8.-.0.0.0.1.-.0.0.1.4.-.8.e.9.2.-.8.3.4.3.e.b.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):65536
    Entropy (8bit):0.9913525648072604
    Encrypted:false
    SSDEEP:192:e4i7OII0BU/wjeTRCKZrwtzuiF9Z24IO8dci:9iCIjBU/wjeYzuiF9Y4IO8dci
    MD5:E0914883176533805511237DD2B438D3
    SHA1:EC239669F2B1371B0BD187B78867BB9107034D9C
    SHA-256:27E905F654FBBA85C62B02CCDFCCDA6A374CDA18995BB4F7C195DEC4EC77026C
    SHA-512:7EA93F8A01BE1EDFDBF40294A2EE32AD95CCF0822675BBB1780DB35E3D988176DCBCC2055CCD148AAB98F448CD9FE4C32BD90926C502CAD9216013B064DDD966
    Malicious:false
    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.7.8.4.4.6.1.8.7.7.0.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.7.8.4.4.9.8.5.9.5.9.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.6.3.8.6.3.d.-.7.9.d.f.-.4.8.e.d.-.9.3.1.d.-.6.1.d.6.4.4.2.6.6.6.4.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.6.6.b.b.3.2.-.e.4.0.2.-.4.c.5.2.-.8.a.c.8.-.7.8.f.8.a.2.2.5.0.b.b.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.6.4.-.0.0.0.1.-.0.0.1.4.-.9.0.6.6.-.a.c.4.9.e.b.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:Mini DuMP crash report, 14 streams, Fri Dec 20 14:27:17 2024, 0x1205a4 type
    Category:dropped
    Size (bytes):45674
    Entropy (8bit):2.0359708545253112
    Encrypted:false
    SSDEEP:192:ZBtq38HDMIXZ2YOQO5H4PWe1MkwnpRegQRaEmC64xId263VB59:Ltq38jM0XOn5HXcRwqAM64QT3B
    MD5:1E29058C405335DAE6AEB1E0435B0029
    SHA1:301E0E8BF79F9D63F906F94D008AA5612E8AD975
    SHA-256:4C11320FE4064230C73E2F08E5C2F0CDD43BC875D6B6E823A0C436ACA97718EF
    SHA-512:B4417E6E4F26BA4101D34BFD5E292580DE76861D3590A85BD4BDF4FD2A7CBE6957CFBAA1B5B01A4F2766C2F98E1D0985224535DD427719A62CBA3C3398BF985D
    Malicious:false
    Preview:MDMP..a..... ........~eg........................`................1..........T.......8...........T.......................................................................................................................eJ....... ......GenuineIntel............T............~eg.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):8278
    Entropy (8bit):3.6968078402591944
    Encrypted:false
    SSDEEP:192:R6l7wVeJnz6w6YUc6ygmfTUjprR489bzV9sfa5tm:R6lXJz6w6YP6ygmfTU/FzV2f4w
    MD5:DA3ECB507E165E523651657F0C1CFAE9
    SHA1:1429826DA3588DE3B9B692A5B6D29C6FF1E87D4E
    SHA-256:F8243CC35FDA7255AE7F6C399864AEE7E9F399F6913D9C10317DCF60C8765A37
    SHA-512:3858BE3F4240F14FC1269639514CE5347B2894CE661832C2231A05B10D1C7D4D78ED5EA6DBC2BDB3FC374984A9D412EE129A9B1BCD31D58DAC779D7C0B21712C
    Malicious:false
    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.4.0.<./.P.i.
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4650
    Entropy (8bit):4.4762564576205435
    Encrypted:false
    SSDEEP:48:cvIwWl8zsVJg77aI9RmWpW8VY3Ym8M4JCdPpLFTX+q8/MEcGScSmd:uIjfvI7Ln7VXJqhgcJ3md
    MD5:96583510BDF81F399109568B83C34AB1
    SHA1:097CFEF878F4CD01E4BCCD414246B7760064C662
    SHA-256:F9F1790CC63D27228130EDB3CB7DB747EBFC07081962C88B5FFDCE682F9BE070
    SHA-512:30FD483FC5ACB0EEEF736A1B177003F78EDCEDF9164FC262892835C5EF1756AD175A611D8A7C2C137DEAD3F958102F77F1CDA9374DC8E03D99BF095554032C4D
    Malicious:false
    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639689" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:Mini DuMP crash report, 14 streams, Fri Dec 20 14:27:27 2024, 0x1205a4 type
    Category:dropped
    Size (bytes):47014
    Entropy (8bit):1.9767458367710418
    Encrypted:false
    SSDEEP:192:ziIz38pi47XZKYOoJO5H4K3jOXZXFzKS31RFqEYuYCxdUJoF:eIz38g4lTOoM5HbCXZYSXFqEFk6
    MD5:139C6B7300E33045DF0816C0DE133029
    SHA1:CD286E07122AEDF563DD6F5074159D4D4BDD578B
    SHA-256:4DBC45A39E779A3DAE499ACDA8C413C9359DC9145AB18CEA94046027A4293CC0
    SHA-512:4A46AB21FB4C2D1759A61B21E617A497C91BA1C2E49E80C2D4BE7C04EC1EA1C436CFD04D64777E55F307A4D3E77EC6BDA59E63DFCCD77B95C98612122004330F
    Malicious:false
    Preview:MDMP..a..... ........~eg........................`................1..........T.......8...........T.......................................................................................................................eJ....... ......GenuineIntel............T.......d....~eg.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):8314
    Entropy (8bit):3.6967434941295183
    Encrypted:false
    SSDEEP:192:R6l7wVeJZC6t6YcB6AHHIgmfTUjpru89bzhgsfr5xm:R6lXJM6t6YC6AHHIgmfTU5zhzf1M
    MD5:01ACBFB655FAD65932CA0AB4567AB69B
    SHA1:544439E38E86F1BF1859EAA2C63E1ED0CB2C5350
    SHA-256:49CF19EBAEC2A83381D300DBC30E077E4108808C4A9FECDB80330B852F62463C
    SHA-512:205E93263D523F0361661391AED7BFF3F8EA75D81E069FDB6F67DCF5C80AD71F4C9259C75D8BC4472EA4951976B12A0DF4AF3DDBE8341D0213D6BF93D04D7763
    Malicious:false
    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.1.2.<./.P.i.
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4650
    Entropy (8bit):4.474881090057337
    Encrypted:false
    SSDEEP:48:cvIwWl8zsnJg77aI9RmWpW8VYCyYm8M4JCdPpLFnd+q8/MELlGScSxd:uIjfJI7Ln7Vp7JqldgLlJ3xd
    MD5:FB592597A0F18F8B7EEC0227B71DAA9E
    SHA1:EA624E95BD6B37C33B9A118367123473BDAA85DC
    SHA-256:345BAC20BDE6126199D9F32AA8BE009C169FCBC87D35A089BCD25DA8750F97B2
    SHA-512:76BEB10980992A894E3B919E60CD4CC31A4686FA0392F14B9C5E5FC63EE6ACEA4888D077EFE9495FD372FB3D76D5201925CB66C7D98D76C3D1023CFFBA3625B6
    Malicious:false
    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639690" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409
    Process:C:\Windows\SysWOW64\WerFault.exe
    File Type:MS Windows registry file, NT/2000 or above
    Category:dropped
    Size (bytes):1835008
    Entropy (8bit):4.466260045962872
    Encrypted:false
    SSDEEP:6144:/IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbG:wXD94+WlLZMM6YFHT+G
    MD5:411B98DC4FC2EDEB73C16A1D64F35D9B
    SHA1:2BBFE1E41B243018453A654E4C6211E7C0C7F2B6
    SHA-256:8027571B7BBB6EF75F58B020C1F309112B3C5EE0BFBB9CFF44A05C98328AB280
    SHA-512:BF4893B2E8BCB906E1607DD9249EE1C3233FBCA7143C3A8C2D7521BCACCB2B641E241C3D6B556209C91DE9B31AE265224F54BAD69B56F3D1244821ACAD8C78D8
    Malicious:false
    Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..gD.R...............................................................................................................................................................................................................................................................................................................................................Kpp........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
    File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
    Entropy (8bit):7.896719028366084
    TrID:
    • Win32 Dynamic Link Library (generic) (1002004/3) 96.66%
    • UPX compressed Win32 Executable (30571/9) 2.95%
    • Generic Win/DOS Executable (2004/3) 0.19%
    • DOS Executable Generic (2002/1) 0.19%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:tTdMHr6SlJ.dll
    File size:5'321'824 bytes
    MD5:b580bfbbff6e7e9e3cc6d04c397a6d68
    SHA1:0464dabfcf01bff7ec7696c844c2d47f95a2a154
    SHA256:40c708f5f85591eab36738ba4df9c46b296bd417bec2c4f5fabfc27b7b5fb317
    SHA512:1c5d8cad440dfdbf306e704f9223ab6f7e325bb15bb4470ea33b427f96e0e64a9c343bb1127b1417fcfc211922020107e4976f676d48ffb2b067ab81bdf1d2eb
    SSDEEP:98304:AHMsLSN04xZqM0mebAuqhOq69XtM0sAfkiPOl2GOs/+QwfprvTT2z7hk+/rlsKVg:vsLSKGq9mmq8JtbkV/+BpM75r2KVNCY+
    TLSH:943622290603A099F3DD147C8FE4AB500267D083B9DB2512EFDDFCA583F99A699D324D
    File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................
    Icon Hash:7ae282899bbab082
    Entrypoint:0x19cf8f0
    Entrypoint Section:UPX1
    Digitally signed:true
    Imagebase:0x40000
    Subsystem:windows gui
    Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
    Time Stamp:0x675F94FF [Mon Dec 16 02:48:31 2024 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:5
    OS Version Minor:0
    File Version Major:5
    File Version Minor:0
    Subsystem Version Major:5
    Subsystem Version Minor:0
    Import Hash:082af2927a8eeb5b190b8dc0d066da58
    Signature Valid:false
    Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
    Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
    Error Number:-2146762495
    Not Before, Not After
    • 13/12/2024 21:10:46 14/12/2025 21:10:46
    Subject Chain
    • E=pagamentosdigitaais@gmail.com, CN=PAGAMENTOS DIGITAIS LTDA, O=PAGAMENTOS DIGITAIS LTDA, L=JOAO PESSOA, S=PARAIBA, C=BR, OID.1.3.6.1.4.1.311.60.2.1.3=BR, SERIALNUMBER=55.972.702/0001-29, OID.2.5.4.15=Private Organization
    Version:3
    Thumbprint MD5:FC24237D18BE5D7114AA3DCDAAE6AD6C
    Thumbprint SHA-1:3C9DB92427EA2A17F23D86D1B5704C90C1949548
    Thumbprint SHA-256:19BAF25862979BC0C7CB3971187128986BEB6DB4A4C6986B452A286850E570B0
    Serial:0B98FD483EA0DD6E7C6A6317
    Instruction
    cmp byte ptr [esp+08h], 00000001h
    jne 00007F6FBCC3149Fh
    pushad
    mov esi, 014E2000h
    lea edi, dword ptr [esi-014A1000h]
    push edi
    or ebp, FFFFFFFFh
    jmp 00007F6FBCC312CFh
    nop
    nop
    nop
    mov al, byte ptr [esi]
    inc esi
    mov byte ptr [edi], al
    inc edi
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F6FBCC312AFh
    mov eax, 00000001h
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc eax, eax
    add ebx, ebx
    jnc 00007F6FBCC312CDh
    jne 00007F6FBCC312EAh
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F6FBCC312E1h
    dec eax
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc eax, eax
    jmp 00007F6FBCC31296h
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc ecx, ecx
    jmp 00007F6FBCC31314h
    xor ecx, ecx
    sub eax, 03h
    jc 00007F6FBCC312D3h
    shl eax, 08h
    mov al, byte ptr [esi]
    inc esi
    xor eax, FFFFFFFFh
    je 00007F6FBCC31337h
    sar eax, 1
    mov ebp, eax
    jmp 00007F6FBCC312CDh
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F6FBCC3128Eh
    inc ecx
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F6FBCC31280h
    add ebx, ebx
    jne 00007F6FBCC312C9h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc ecx, ecx
    add ebx, ebx
    jnc 00007F6FBCC312B1h
    jne 00007F6FBCC312CBh
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jnc 00007F6FBCC312A6h
    add ecx, 02h
    cmp ebp, 00000000h
    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x19925980x21ba0.rsrc
    IMAGE_DIRECTORY_ENTRY_IMPORT0x19922700x328.rsrc
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x19900000x2270.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x5122000x1260UPX0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x19b41380xc.rsrc
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x3210000xa9aUPX0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
    UPX00x10000x14a10000x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    UPX10x14a20000x4ee0000x4edc0027ae6b626c5d9841ee922abd19f08ff9unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .rsrc0x19900000x250000x24200e463c18f66cdea756520655423f3286eFalse0.2667941717128028data5.910857732211721IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    NameRVASizeTypeLanguageCountryZLIB Complexity
    RT_CURSOR0x38b2700x134emptyPortugueseBrazil0
    RT_CURSOR0x38b3a40x134emptyEnglishUnited States0
    RT_CURSOR0x38b4d80x134emptyEnglishUnited States0
    RT_CURSOR0x38b60c0x134emptyEnglishUnited States0
    RT_CURSOR0x38b7400x134emptyEnglishUnited States0
    RT_CURSOR0x38b8740x134emptyEnglishUnited States0
    RT_CURSOR0x38b9a80x134emptyEnglishUnited States0
    RT_CURSOR0x38badc0x134emptyEnglishUnited States0
    RT_BITMAP0x38bc100xe1f2cemptyPortugueseBrazil0
    RT_BITMAP0x46db3c0x1d0emptyEnglishUnited States0
    RT_BITMAP0x46dd0c0x1e4emptyEnglishUnited States0
    RT_BITMAP0x46def00x1d0emptyEnglishUnited States0
    RT_BITMAP0x46e0c00x1d0emptyEnglishUnited States0
    RT_BITMAP0x46e2900x1d0emptyEnglishUnited States0
    RT_BITMAP0x46e4600x1d0emptyEnglishUnited States0
    RT_BITMAP0x46e6300x1d0emptyEnglishUnited States0
    RT_BITMAP0x46e8000x1d0emptyEnglishUnited States0
    RT_BITMAP0x46e9d00x1d0emptyEnglishUnited States0
    RT_BITMAP0x46eba00x1d0emptyEnglishUnited States0
    RT_BITMAP0x46ed700xe4c04emptyPortugueseBrazil0
    RT_BITMAP0x5539740xe44d8emptyPortugueseBrazil0
    RT_BITMAP0x637e4c0xe44d0emptyPortugueseBrazil0
    RT_BITMAP0x71c31c0xe4c64emptyPortugueseBrazil0
    RT_BITMAP0x800f800xe1f2cemptyPortugueseBrazil0
    RT_BITMAP0x8e2eac0xe1f2cemptyPortugueseBrazil0
    RT_BITMAP0x9c4dd80xe1f2cemptyPortugueseBrazil0
    RT_BITMAP0xaa6d040xe35a8emptyPortugueseBrazil0
    RT_BITMAP0xb8a2ac0xe3d48emptyPortugueseBrazil0
    RT_BITMAP0xc6dff40xe1f2cemptyPortugueseBrazil0
    RT_BITMAP0xd4ff200xe4c64emptyPortugueseBrazil0
    RT_BITMAP0xe34b840xddb88emptyPortugueseBrazil0
    RT_BITMAP0xf1270c0xe4c64emptyPortugueseBrazil0
    RT_BITMAP0xff73700xe4c64emptyPortugueseBrazil0
    RT_BITMAP0x10dbfd40xc8a28emptyPortugueseBrazil0
    RT_BITMAP0x11a49fc0xe982cemptyPortugueseBrazil0
    RT_BITMAP0x128e2280xc8a28emptyPortugueseBrazil0
    RT_BITMAP0x1356c500xe3d48emptyPortugueseBrazil0
    RT_BITMAP0x143a9980xe1f2cemptyPortugueseBrazil0
    RT_BITMAP0x151c8c40xe3d4cdataPortugueseBrazil0.976133631091432
    RT_BITMAP0x16006100xe982cdataPortugueseBrazil0.9776049181356251
    RT_STRING0x16e9e3c0x42cdata1.0102996254681649
    RT_STRING0x16ea2680xa98data0.9778761061946902
    RT_STRING0x16ead000x994data1.0
    RT_STRING0x16eb6940xd28data0.9958432304038005
    RT_STRING0x16ec3bc0xc38data1.0015984654731458
    RT_STRING0x16ecff40xad0data1.0025289017341041
    RT_STRING0x16edac40x818data1.0053088803088803
    RT_STRING0x16ee2dc0x820data1.0052884615384616
    RT_STRING0x16eeafc0x2fcdata1.0143979057591623
    RT_STRING0x16eedf80x320data1.01375
    RT_STRING0x16ef1180x3e4data1.0110441767068272
    RT_STRING0x16ef4fc0x3d8data1.011178861788618
    RT_STRING0x16ef8d40x400data1.0107421875
    RT_STRING0x16efcd40x478data1.0096153846153846
    RT_STRING0x16f014c0x398data1.0119565217391304
    RT_STRING0x16f04e40x3e4data1.0110441767068272
    RT_STRING0x16f08c80x2e4data1.0108108108108107
    RT_STRING0x16f0bac0x318data1.0075757575757576
    RT_STRING0x16f0ec40x454data1.009927797833935
    RT_STRING0x16f13180x300data1.0143229166666667
    RT_STRING0x16f16180x43cdata0.9972324723247232
    RT_STRING0x16f1a540xa0data1.06875
    RT_STRING0x16f1af40xe4data1.0482456140350878
    RT_STRING0x16f1bd80x1b4data1.025229357798165
    RT_STRING0x16f1d8c0x310data1.0140306122448979
    RT_STRING0x16f209c0x410data1.001923076923077
    RT_STRING0x16f24ac0x368data1.0126146788990826
    RT_STRING0x16f28140x4b4data1.0091362126245846
    RT_STRING0x16f2cc80x2e8data1.0147849462365592
    RT_STRING0x16f2fb00x3f8data1.0108267716535433
    RT_STRING0x16f33a80x498data1.0093537414965987
    RT_STRING0x16f38400x5e0data1.007313829787234
    RT_STRING0x16f3e200x4dcdata1.0088424437299035
    RT_STRING0x16f42fc0x380data1.0122767857142858
    RT_STRING0x16f467c0x3c0data1.0114583333333333
    RT_STRING0x16f4a3c0x414data1.010536398467433
    RT_STRING0x16f4e500x108data1.0416666666666667
    RT_STRING0x16f4f580xccdata1.053921568627451
    RT_STRING0x16f50240x244DOS executable (COM, 0x8C-variant)1.0189655172413794
    RT_STRING0x16f52680x414data1.010536398467433
    RT_STRING0x16f567c0x37cdata1.0123318385650224
    RT_STRING0x16f59f80x2ecdata1.0147058823529411
    RT_STRING0x16f5ce40x364data1.012672811059908
    RT_RCDATA0x16f60480xb3f8dataPortugueseBrazil0.9909489494703941
    RT_RCDATA0x17014400x482bdataPortugueseBrazil0.975426251691475
    RT_RCDATA0x1705c6c0x9d9ddataPortugueseBrazil0.978685964955761
    RT_RCDATA0x170fa0c0xd02fdataPortugueseBrazil0.9738437001594896
    RT_RCDATA0x171ca3c0x2700fdataPortugueseBrazil0.9771718651218397
    RT_RCDATA0x1743a4c0xe6c6dataPortugueseBrazil0.974423643319002
    RT_RCDATA0x17521140x5c11dataPortugueseBrazil0.9845135559421274
    RT_RCDATA0x1757d280x10data1.5
    RT_RCDATA0x1757d380x6532dataPortugueseBrazil0.9871072338454412
    RT_RCDATA0x175e26c0x8f8cCOM executable for DOSPortugueseBrazil0.9830739087841516
    RT_RCDATA0x17671f80x7df5dataPortugueseBrazil0.9838734687548457
    RT_RCDATA0x176eff00x3f33dataPortugueseBrazil0.9821991470424625
    RT_RCDATA0x1772f240x53b4adataPortugueseBrazil0.9807267148498795
    RT_RCDATA0x17c6a700x10ed9dataPortugueseBrazil0.9846546576863724
    RT_RCDATA0x17d794c0xa073dataPortugueseBrazil0.9876323797930615
    RT_RCDATA0x17e19c00x5f78dataPortugueseBrazil0.9877250409165302
    RT_RCDATA0x17e79380x91dbdataPortugueseBrazil0.9875197514662953
    RT_RCDATA0x17f0b140x4e45dataPortugueseBrazil0.98597594450267
    RT_RCDATA0x17f595c0x82b7dataPortugueseBrazil0.9864626602516212
    RT_RCDATA0x17fdc140x943cdataPortugueseBrazil0.9883524823442605
    RT_RCDATA0x18070500x485bdataPortugueseBrazil0.9847216973492415
    RT_RCDATA0x180b8ac0x95efdataPortugueseBrazil0.9844462392204882
    RT_RCDATA0x1814e9c0xa010dataPortugueseBrazil0.9855525185474424
    RT_RCDATA0x181eeac0x107cdata0.9931279620853081
    RT_RCDATA0x181ff280x9e23dataPortugueseBrazil0.9848578415631253
    RT_RCDATA0x1829d4c0x48acdataPortugueseBrazil0.9841431950118255
    RT_RCDATA0x182e5f80xc252dataPortugueseBrazil0.9854862702528846
    RT_RCDATA0x183a84c0x6fe0dataPortugueseBrazil0.9824022346368715
    RT_RCDATA0x184182c0xb5a9dataPortugueseBrazil0.985334910224707
    RT_RCDATA0x184cdd80x176c9dataPortugueseBrazil0.9852415446349471
    RT_RCDATA0x18644a40x9a56dataPortugueseBrazil0.9850923816755252
    RT_RCDATA0x186defc0x2a5data1.016248153618907
    RT_RCDATA0x186e1a40xb37adataPortugueseBrazil0.9831323727854437
    RT_RCDATA0x18795200x640ddataPortugueseBrazil0.9828602662710343
    RT_RCDATA0x187f9300x1d8data1.0233050847457628
    RT_RCDATA0x187fb080x1bedata1.0246636771300448
    RT_RCDATA0x187fcc80x1bedata1.0246636771300448
    RT_RCDATA0x187fe880x1bedata1.0246636771300448
    RT_RCDATA0x18800480x1bedata1.0246636771300448
    RT_RCDATA0x18802080x1bedata1.0246636771300448
    RT_RCDATA0x18803c80x1bedata1.0246636771300448
    RT_RCDATA0x18805880x2f9data1.014454664914586
    RT_RCDATA0x18808840x13a93dataPortugueseBrazil0.9879301138691933
    RT_RCDATA0x18943180x1342fdataPortugueseBrazil0.9831294758856708
    RT_RCDATA0x18a77480xd5bfdataPortugueseBrazil0.9833695791224255
    RT_RCDATA0x18b4d080x677dataPortugueseBrazil1.0066465256797583
    RT_RCDATA0x18b53800xb0a0dataPortugueseBrazil0.9845408704883227
    RT_RCDATA0x18c04200x11557dataPortugueseBrazil0.9833096240792124
    RT_RCDATA0x18d19780xda6adataPortugueseBrazil0.984154236863755
    RT_RCDATA0x18df3e40xda85dataPortugueseBrazil0.9855562110080263
    RT_RCDATA0x18ece6c0x5a42OpenPGP Secret KeyPortugueseBrazil0.9869730805851294
    RT_RCDATA0x18f28b00x5341dataPortugueseBrazil0.986627879697837
    RT_RCDATA0x18f7bf40x67afdataPortugueseBrazil0.9848924386843989
    RT_RCDATA0x18fe3a40x3ff7bdataPortugueseBrazil0.9864280507306945
    RT_RCDATA0x193e3200xbe92dataPortugueseBrazil0.9915344566064035
    RT_RCDATA0x194a1b40xae2bdataPortugueseBrazil0.9892345302442416
    RT_RCDATA0x1954fe00x516fdataPortugueseBrazil0.993620185158536
    RT_RCDATA0x195a1500x6371dataPortugueseBrazil0.9819303138625918
    RT_RCDATA0x19604c40x8fd1dataPortugueseBrazil0.9829155009913898
    RT_GROUP_CURSOR0x19694980x14dataPortugueseBrazil1.45
    RT_GROUP_CURSOR0x19694ac0x14dataEnglishUnited States1.4
    RT_GROUP_CURSOR0x19694c00x14Non-ISO extended-ASCII text, with no line terminatorsEnglishUnited States1.45
    RT_GROUP_CURSOR0x19694d40x14Non-ISO extended-ASCII text, with no line terminatorsEnglishUnited States1.45
    RT_GROUP_CURSOR0x19694e80x14dataEnglishUnited States1.45
    RT_GROUP_CURSOR0x19694fc0x14dataEnglishUnited States1.45
    RT_GROUP_CURSOR0x19695100x14dataEnglishUnited States1.45
    RT_GROUP_CURSOR0x19695240x14dataEnglishUnited States1.35
    DLLImport
    advapi32.dllRegCloseKey
    comctl32.dllImageList_Add
    gdi32.dllPie
    KERNEL32.DLLLoadLibraryA, GetProcAddress, VirtualProtect
    Magnification.dllMagInitialize
    msvcrt.dllmemset
    netapi32.dllNetWkstaGetInfo
    ole32.dllOleDraw
    oleaut32.dllVariantCopy
    shell32.dllSHGetFolderPathW
    user32.dllGetDC
    version.dllVerQueryValueW
    winspool.drvOpenPrinterW
    wsock32.dllsend
    Language of compilation systemCountry where language is spokenMap
    PortugueseBrazil
    EnglishUnited States
    TimestampSource PortDest PortSource IPDest IP
    Dec 20, 2024 15:27:30.555602074 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:30.675340891 CET804973823.94.207.151192.168.2.4
    Dec 20, 2024 15:27:30.675432920 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:30.684495926 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:30.684495926 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:30.804363966 CET804973823.94.207.151192.168.2.4
    Dec 20, 2024 15:27:30.804387093 CET804973823.94.207.151192.168.2.4
    Dec 20, 2024 15:27:32.001101017 CET804973823.94.207.151192.168.2.4
    Dec 20, 2024 15:27:32.065051079 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:37.005887985 CET804973823.94.207.151192.168.2.4
    Dec 20, 2024 15:27:37.006108999 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:37.006108999 CET4973880192.168.2.423.94.207.151
    Dec 20, 2024 15:27:37.125837088 CET804973823.94.207.151192.168.2.4
    • 23.94.207.151
    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
    0192.168.2.44973823.94.207.151806988C:\Windows\SysWOW64\rundll32.exe
    TimestampBytes transferredDirectionData
    Dec 20, 2024 15:27:30.684495926 CET251OUTPOST /avs_coin/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded; Charset=UTF-8
    Accept: */*
    User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
    Content-Length: 135
    Host: 23.94.207.151
    Dec 20, 2024 15:27:30.684495926 CET135OUTData Raw: 6f 70 3d 70 6e 39 55 71 2b 53 6f 4d 56 70 43 54 79 56 79 61 32 77 52 61 41 64 77 41 77 41 42 44 53 67 76 4d 56 6b 6a 42 6c 6c 66 56 6c 78 44 52 68 59 47 43 42 6c 62 57 30 4a 4b 57 42 68 65 52 56 64 66 46 41 4d 43 64 56 46 4e 47 54 5a 50 49 53 38
    Data Ascii: op=pn9Uq+SoMVpCTyVya2wRaAdwAwABDSgvMVkjBllfVlxDRhYGCBlbW0JKWBheRVdfFAMCdVFNGTZPIS8YfnV9ZGcVcnJ+fCQvKSglcmsDAhwFBxkFCAteS1xDQmMHCwAKaRY=
    Dec 20, 2024 15:27:32.001101017 CET203INHTTP/1.1 200 OK
    Date: Fri, 20 Dec 2024 14:27:31 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8


    Click to jump to process

    Click to jump to process

    Click to dive into process behavior distribution

    Click to jump to process

    Target ID:0
    Start time:09:27:13
    Start date:20/12/2024
    Path:C:\Windows\System32\loaddll32.exe
    Wow64 process (32bit):true
    Commandline:loaddll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll"
    Imagebase:0x120000
    File size:126'464 bytes
    MD5 hash:51E6071F9CBA48E79F10C84515AAE618
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:false

    Target ID:1
    Start time:09:27:13
    Start date:20/12/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff7699e0000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:false

    Target ID:2
    Start time:09:27:14
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\cmd.exe
    Wow64 process (32bit):true
    Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1
    Imagebase:0x240000
    File size:236'544 bytes
    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    Target ID:3
    Start time:09:27:14
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x000025F0
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:true

    Target ID:4
    Start time:09:27:14
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",#1
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:true

    Target ID:7
    Start time:09:27:15
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\WerFault.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 776
    Imagebase:0x900000
    File size:483'680 bytes
    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    Target ID:8
    Start time:09:27:17
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00060E00
    Imagebase:0xee0000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:true

    Target ID:9
    Start time:09:27:20
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe C:\Users\user\Desktop\tTdMHr6SlJ.dll,Address: 0x00077A00
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:true

    Target ID:10
    Start time:09:27:24
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x000025F0
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:true

    Target ID:11
    Start time:09:27:24
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00060E00
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Reputation:high
    Has exited:true

    Target ID:12
    Start time:09:27:24
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",Address: 0x00077A00
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:13
    Start time:09:27:24
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",dbkFCallWrapperAddr
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:14
    Start time:09:27:24
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",__dbk_fcall_wrapper
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:16
    Start time:09:27:24
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write_noraise
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:false

    Target ID:17
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_write
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:18
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_uop_symbols_test
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:19
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_union_type_or
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:20
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\WerFault.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 768
    Imagebase:0x900000
    File size:483'680 bytes
    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    Target ID:21
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex_bytes_with_sep
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:22
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_strhex
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:23
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_stat
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:24
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable_async_safe
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:25
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_set_inheritable
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:26
    Start time:09:27:25
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open_noraise
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:27
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_open
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:28
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_normpath
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:29
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_steal
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:30
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_size
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:31
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_set
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:32
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new_full
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:33
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_new
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:34
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_len
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:35
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_hash_ptr
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:36
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_get
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:37
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_foreach
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:38
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_destroy
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:39
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_compare_direct
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:40
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_hashtable_clear
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    Target ID:41
    Start time:09:27:26
    Start date:20/12/2024
    Path:C:\Windows\SysWOW64\rundll32.exe
    Wow64 process (32bit):true
    Commandline:rundll32.exe "C:\Users\user\Desktop\tTdMHr6SlJ.dll",_Py_get_osfhandle
    Imagebase:0xc30000
    File size:61'440 bytes
    MD5 hash:889B99C52A60DD49227C5E485A016679
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Borland Delphi
    Has exited:true

    No disassembly