Play interactive tour

Edit tour

Analysis Report fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Overview

General Information

Sample Name:	fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll
Analysis ID:	399327
MD5:	526bd61e387de23722e171a34dcd7016
SHA1:	9007dece802951a0f29c9ab84085e7d1920099f6
SHA256:	7d35c3abef65ed1d81d2f70944db31ba2a8cc703f1ccf8b82ca7b3929b8233e1
Tags:	Trickbot
Infos:
Most interesting Screenshot:

Detection

Trickbot

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Trickbot

Allocates memory in foreign processes

Delayed program exit found

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

May check the online IP address of the machine

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Startup

System is w10x64

loaddll32.exe (PID: 2272 cmdline: loaddll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4940 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 1068 cmdline: rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 6176 cmdline: C:\Windows\system32\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

WerFault.exe (PID: 6336 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 712 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 4012 cmdline: rundll32.exe C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll,StartW MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 6164 cmdline: C:\Windows\system32\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

WerFault.exe (PID: 6320 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 704 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 6328 cmdline: rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',StartW MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 6380 cmdline: C:\Windows\system32\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

WerFault.exe (PID: 6480 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 712 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Trickbot

{"ver": "2000029", "gtag": "che7", "servs": ["103.66.72.217:443", "117.252.68.211:443", "103.124.173.35:443", "115.73.211.230:443", "117.54.250.246:443", "131.0.112.122:443", "69.109.35.254:20445", "43.17.158.63:36366", "130.180.24.227:44321", "131.168.228.35:19932", "185.31.222.247:49372", "151.187.13.249:46881", "190.186.36.209:40737", "42.139.161.213:11056", "23.95.165.4:64265", "189.169.15.32:42761", "125.6.227.80:58405", "217.159.190.123:8412", "47.106.66.231:10710", "46.136.156.92:5385"], "autorun": ["pwgrab"], "ecc_key": "RUNTMzAAAAAL/ZqmMPBLaRfg1hPOtFJrZz2Zi2/EC4B3fiX8VnaOUVKndBr+jEqWc7mw4v3ADTiwp64K5QKe1LZ27jUZxL4bWjxARPo85hv72nuedeZhRQ+adQQ/gIsV869MycRzghc="}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000005.00000002.368401033.0000000004B00000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
0000000C.00000002.358957054.0000000004FA0000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000002.316290050.0000000000C50000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000002.301654688.0000000000BB0000.00000004.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000005.00000002.345834553.00000000032B0000.00000004.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000002.342880872.00000000047F0000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
0000000C.00000002.330027529.0000000003410000.00000004.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
0000000C.00000002.330091629.00000000034B0000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
Process Memory Space: wermgr.exe PID: 6380	JoeSecurity_Trickbot_1	Yara detected Trickbot	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.rundll32.exe.4b00000.3.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
5.2.rundll32.exe.4b00000.3.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
12.2.rundll32.exe.4fa0000.3.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
5.2.rundll32.exe.32b0000.1.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
12.2.rundll32.exe.3410000.1.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
4.2.rundll32.exe.47f0000.3.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
12.2.rundll32.exe.4fa0000.3.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
4.2.rundll32.exe.47f0000.3.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
4.2.rundll32.exe.bb0000.2.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp

Malware Configuration Extractor: Trickbot {"ver": "2000029", "gtag": "che7", "servs": ["103.66.72.217:443", "117.252.68.211:443", "103.124.173.35:443", "115.73.211.230:443", "117.54.250.246:443", "131.0.112.122:443", "69.109.35.254:20445", "43.17.158.63:36366", "130.180.24.227:44321", "131.168.228.35:19932", "185.31.222.247:49372", "151.187.13.249:46881", "190.186.36.209:40737", "42.139.161.213:11056", "23.95.165.4:64265", "189.169.15.32:42761", "125.6.227.80:58405", "217.159.190.123:8412", "47.106.66.231:10710", "46.136.156.92:5385"], "autorun": ["pwgrab"], "ecc_key": "RUNTMzAAAAAL/ZqmMPBLaRfg1hPOtFJrZz2Zi2/EC4B3fiX8VnaOUVKndBr+jEqWc7mw4v3ADTiwp64K5QKe1LZ27jUZxL4bWjxARPo85hv72nuedeZhRQ+adQQ/gIsV869MycRzghc="}

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 6380, type: MEMORY

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 117.252.68.211:443 -> 192.168.2.5:49712 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 117.252.68.211:443 -> 192.168.2.5:49717 version: TLS 1.0

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: powrprof.pdbx\6'r source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbX source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.248508121.0000000000D48000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254112821.0000000003472000.00000004.00000001.sdmp
Source:	Binary string: winspool.pdbD source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb* source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbp source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.248501832.0000000000D42000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.251016998.00000000033F3000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254564829.000000000346C000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdbf\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbs source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.250318981.00000000033FF000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254424830.0000000003478000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb, source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb_ source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbr\0'i source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbqI7'd source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbB source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbL source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.248501832.0000000000D42000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.251016998.00000000033F3000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdba source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb#d source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbz source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbZ\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdbf source: WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbm source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdbN source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbA7 source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb)I source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbg source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdbh source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb~\<'e source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdby source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbl\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbf source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.249353922.0000000000D4E000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.250318981.00000000033FF000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254424830.0000000003478000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdbV source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.248508121.0000000000D48000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.250294762.00000000033F9000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254112821.0000000003472000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb\| source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb`\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdbe source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbE source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp

Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE4800 FindFirstFileW,		14_2_0000024B66AE4800
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEAC30 FindFirstFileW,FindNextFileW,		14_2_0000024B66AEAC30

Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000002360243A940
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec edi	6_2_00000236024459A0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000002360244B5B0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_000002360245423F
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000002360244EA50
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ebp	6_2_0000023602434670
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_00000236024542CD
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_0000023602452EE0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_00000236024542EF
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_00000236024542AF
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_0000023602454336
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_0000023602454355
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000002360243BB70
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_0000023602450B70
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	6_2_000002360245431B
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then cmp dword ptr [eax], ecx	6_2_0000023602439380
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_0000023602436B90
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec ecx	6_2_0000023602440060
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_0000023602440060
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000002360244F460
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx edx, word ptr [eax]	6_2_000002360243AC30
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ebx, edx	6_2_00000236024438C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00000236024438C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00000236024484D0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ecx, word ptr [eax+02h]	6_2_000002360243E8E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000002360244DCE0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_00000236024354F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00000236024408F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_0000023602437890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_0000023602452CB0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ecx	6_2_000002360243E570
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then call 000002360244A610h	6_2_0000023602446510
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D2A940
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec ecx	7_2_0000023538D30060
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D30060
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D3F460
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	7_2_0000023538D27890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx edx, word ptr [eax]	7_2_0000023538D2AC30
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ecx	7_2_0000023538D2E570
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D308F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	7_2_0000023538D254F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ecx, word ptr [eax+02h]	7_2_0000023538D2E8E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D3DCE0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then call 0000023538D3A610h	7_2_0000023538D36510
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D42CB0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D384D0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ebx, edx	7_2_0000023538D338C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D338C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ebp	7_2_0000023538D24670
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D3EA50
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D4423F
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D3B5B0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec edi	7_2_0000023538D359A0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D2BB70
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D40B70
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D44355
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	7_2_0000023538D26B90
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then cmp dword ptr [eax], ecx	7_2_0000023538D29380
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D4431B
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D44336
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D442EF
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	7_2_0000023538D42EE0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D442AF
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	7_2_0000023538D442CD
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx edx, word ptr [eax]	14_2_0000024B66AEAC30
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AEA940
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	14_2_0000024B66AE6B90
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AEBB70
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66B00B70
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then cmp dword ptr [eax], ecx	14_2_0000024B66AE9380
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B0431B
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B042EF
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B04355
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B04336
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	14_2_0000024B66AE7890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AFDCE0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AF84D0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	14_2_0000024B66AE64E6
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ecx, word ptr [eax+02h]	14_2_0000024B66AEE8E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66B02CB0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ebx, edx	14_2_0000024B66AF38C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AF38C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AFF460
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec ecx	14_2_0000024B66AF0060
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AF0060
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec edi	14_2_0000024B66AF59A0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ecx	14_2_0000024B66AEE570
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AFB5B0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then call 0000024B66AFA610h	14_2_0000024B66AF6510
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AF08F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	14_2_0000024B66AE54F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ebp	14_2_0000024B66AE4670
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66B02EE0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B042CD
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B042AF
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	14_2_0000024B66AFEA50
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov esi, esi	14_2_0000024B66B0423F

Networking:

May check the online IP address of the machine

Show sources

Source: C:\Windows\System32\wermgr.exe	DNS query: name: ipinfo.io
Source: C:\Windows\System32\wermgr.exe	DNS query: name: ipinfo.io

Source: Joe Sandbox View

ASN Name: BSNL-NIBNationalInternetBackboneIN BSNL-NIBNationalInternetBackboneIN

Source: Joe Sandbox View

JA3 fingerprint: 8916410db85077a5460817142dcbc8de

Source: unknown	HTTPS traffic detected: 117.252.68.211:443 -> 192.168.2.5:49712 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 117.252.68.211:443 -> 192.168.2.5:49717 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 117.252.68.211

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.74.0Host: ipinfo.io

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: wermgr.exe, 0000000E.00000003.364146908.0000024B000C7000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WerFault.exe, 00000011.00000002.329242454.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.mm
Source: wermgr.exe, 0000000E.00000002.645299859.0000024B66CB8000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabn
Source: wermgr.exe, 0000000E.00000003.354988320.0000024B00061000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/o
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: http://ipinfo.io:80/ip
Source: wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/
Source: wermgr.exe, 0000000E.00000002.644986028.0000024B66C78000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/I
Source: wermgr.exe, 00000007.00000002.637747793.0000023538F6E000.00000004.00000020.sdmp, wermgr.exe, 00000007.00000002.637307214.0000023538F21000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.01BBF31298B77829737BB7961939977F/5/kps/
Source: wermgr.exe, 00000007.00000002.637307214.0000023538F21000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.01BBF31298B77829737BB7961939977F/5/kps/~
Source: wermgr.exe, 0000000E.00000002.645516304.0000024B66CDA000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/0/Windows%2010%20x64/1
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/EW
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/w
Source: wermgr.exe, 0000000E.00000002.645516304.0000024B66CDA000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/path/C:%5CUsers%5Ca
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/user/user/0/T
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/
Source: wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/$
Source: wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029///0/
Source: wermgr.exe, 0000000E.00000002.645446388.0000024B66CD5000.00000004.00000020.sdmp, wermgr.exe, 0000000E.00000002.644986028.0000024B66C78000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/5/kps/
Source: wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/der
Source: wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/derMHZ:2
Source: wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211/rguH2:(
Source: wermgr.exe, 00000007.00000002.637461915.0000023538F3C000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/vider
Source: wermgr.exe, 00000007.00000002.637461915.0000023538F3C000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/viderk
Source: wermgr.exe, 00000007.00000002.637461915.0000023538F3C000.00000004.00000020.sdmp	String found in binary or memory: https://117.252.68.211/videro
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/user/user/0/
Source: wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	String found in binary or memory: https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/Q
Source: wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	String found in binary or memory: https://watson.telemet
Source: wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	String found in binary or memory: https://watson.telemetpinfo.io/

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

E-Banking Fraud:

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 6380, type: MEMORY

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602440E30 NtQuerySystemInformation,DuplicateHandle,RtlDeleteBoundaryDescriptor,	6_2_0000023602440E30
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243B040 NtDelayExecution,	6_2_000002360243B040
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2B040 NtDelayExecution,	7_2_0000023538D2B040
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D30E30 NtQuerySystemInformation,DuplicateHandle,RtlDeleteBoundaryDescriptor,	7_2_0000023538D30E30
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEB040 NtDelayExecution,	14_2_0000024B66AEB040
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF0E30 NtQuerySystemInformation,DuplicateHandle,	14_2_0000024B66AF0E30

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD3C19C	4_2_6DD3C19C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD3A853	4_2_6DD3A853
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD84DDD	4_2_6DD84DDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD321C0	4_2_6DD321C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD69660	4_2_6DD69660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD36369	4_2_6DD36369
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD31000	4_2_6DD31000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7260C	4_2_6DD7260C
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602440E30	6_2_0000023602440E30
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602448FF0	6_2_0000023602448FF0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602442CB0	6_2_0000023602442CB0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024385C0	6_2_00000236024385C0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024325D0	6_2_00000236024325D0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024459A0	6_2_00000236024459A0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360244C1A0	6_2_000002360244C1A0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024385B0	6_2_00000236024385B0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360244D670	6_2_000002360244D670
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360244FE10	6_2_000002360244FE10
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602435620	6_2_0000023602435620
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243F630	6_2_000002360243F630
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602449ED0	6_2_0000023602449ED0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602431AF0	6_2_0000023602431AF0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602439750	6_2_0000023602439750
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360244A760	6_2_000002360244A760
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243BB70	6_2_000002360243BB70
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602440300	6_2_0000023602440300
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602432B10	6_2_0000023602432B10
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602450320	6_2_0000023602450320
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024333E0	6_2_00000236024333E0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243DBE0	6_2_000002360243DBE0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243CBF0	6_2_000002360243CBF0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243EFB0	6_2_000002360243EFB0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360244BC40	6_2_000002360244BC40
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602448800	6_2_0000023602448800
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243E8E0	6_2_000002360243E8E0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360244D0A0	6_2_000002360244D0A0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024370B0	6_2_00000236024370B0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602433160	6_2_0000023602433160
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D38FF0	7_2_0000023538D38FF0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D32CB0	7_2_0000023538D32CB0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D30E30	7_2_0000023538D30E30
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D3BC40	7_2_0000023538D3BC40
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2CBF0	7_2_0000023538D2CBF0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2DBE0	7_2_0000023538D2DBE0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D233E0	7_2_0000023538D233E0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D38800	7_2_0000023538D38800
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2EFB0	7_2_0000023538D2EFB0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D23160	7_2_0000023538D23160
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2E8E0	7_2_0000023538D2E8E0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D270B0	7_2_0000023538D270B0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D3D0A0	7_2_0000023538D3D0A0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D3D670	7_2_0000023538D3D670
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2F630	7_2_0000023538D2F630
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D25620	7_2_0000023538D25620
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D3FE10	7_2_0000023538D3FE10
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D285B0	7_2_0000023538D285B0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D359A0	7_2_0000023538D359A0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D3C1A0	7_2_0000023538D3C1A0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D225D0	7_2_0000023538D225D0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D285C0	7_2_0000023538D285C0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2BB70	7_2_0000023538D2BB70
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D3A760	7_2_0000023538D3A760
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D40320	7_2_0000023538D40320
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D29750	7_2_0000023538D29750
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D21AF0	7_2_0000023538D21AF0
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D22B10	7_2_0000023538D22B10
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D30300	7_2_0000023538D30300
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D39ED0	7_2_0000023538D39ED0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEDBE0	14_2_0000024B66AEDBE0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE9750	14_2_0000024B66AE9750
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF2CB0	14_2_0000024B66AF2CB0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF8FF0	14_2_0000024B66AF8FF0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AFFE10	14_2_0000024B66AFFE10
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF0E30	14_2_0000024B66AF0E30
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEBB70	14_2_0000024B66AEBB70
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE33E0	14_2_0000024B66AE33E0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEEFB0	14_2_0000024B66AEEFB0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66B00320	14_2_0000024B66B00320
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE2B10	14_2_0000024B66AE2B10
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE1AF0	14_2_0000024B66AE1AF0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF0300	14_2_0000024B66AF0300
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AFA760	14_2_0000024B66AFA760
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AFD0A0	14_2_0000024B66AFD0A0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEE8E0	14_2_0000024B66AEE8E0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE70B0	14_2_0000024B66AE70B0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AECBF0	14_2_0000024B66AECBF0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF8800	14_2_0000024B66AF8800
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AFBC40	14_2_0000024B66AFBC40
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AFC1A0	14_2_0000024B66AFC1A0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF59A0	14_2_0000024B66AF59A0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE25D0	14_2_0000024B66AE25D0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE85B0	14_2_0000024B66AE85B0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE85C0	14_2_0000024B66AE85C0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE3160	14_2_0000024B66AE3160
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AFD670	14_2_0000024B66AFD670
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF9ED0	14_2_0000024B66AF9ED0
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE5620	14_2_0000024B66AE5620
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEF630	14_2_0000024B66AEF630

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 704

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal88.troj.evad.winDLL@18/14@6/2

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0000023602431140 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,	6_2_0000023602431140
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D21140 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,	7_2_0000023538D21140
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE1140 LookupPrivilegeValueW,AdjustTokenPrivileges,FindCloseChangeNotification,	14_2_0000024B66AE1140

Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{AEA18584-0038-9132-02E4-0103AD92A638}
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{A4C9D524-837C-DBA0-D23E-0C8E604322CF}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4012
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1068
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6328
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{4D3FAD72-FE30-7ED6-EA1F-2C351733F4E2}

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER63EC.tmp

Jump to behavior

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wermgr.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Windows\System32\wermgr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll,StartW

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll,StartW
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 704
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',StartW
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 712
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 712
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll,StartW	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',StartW	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static file information: File size 1375832 > 1048576

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: powrprof.pdbx\6'r source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbX source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.248508121.0000000000D48000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254112821.0000000003472000.00000004.00000001.sdmp
Source:	Binary string: winspool.pdbD source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb* source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbp source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.248501832.0000000000D42000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.251016998.00000000033F3000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254564829.000000000346C000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdbf\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbs source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.250318981.00000000033FF000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254424830.0000000003478000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb, source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb_ source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbr\0'i source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbqI7'd source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbB source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbL source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.248501832.0000000000D42000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.251016998.00000000033F3000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdba source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb#d source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbz source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbZ\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdbf source: WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbm source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdbN source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbA7 source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb)I source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbg source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdbh source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb~\<'e source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdby source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbl\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbf source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.249353922.0000000000D4E000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.250318981.00000000033FF000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254424830.0000000003478000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.254685789.00000000050B0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255938267.0000000005500000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262190349.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdbV source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.248508121.0000000000D48000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.250294762.00000000033F9000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.254112821.0000000003472000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb\| source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.254673935.0000000004F81000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.255887896.0000000005531000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.262174486.00000000054E1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb`\ source: WerFault.exe, 0000000D.00000003.255956920.0000000005506000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdbe source: WerFault.exe, 00000011.00000003.262206454.00000000056B6000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbE source: WerFault.exe, 0000000B.00000003.254702397.00000000050B6000.00000004.00000040.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6DD321C0 StartW,VirtualAlloc,VirtualFree,LoadLibraryA,GetProcAddress,

4_2_6DD321C0

Source: fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Static PE information: real checksum: 0x159dea should be: 0x1571de

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_047F1151 push 82D6EFF1h; retn B17Eh	4_2_047F130A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B01151 push 82D6EFF1h; retn B17Eh	5_2_04B0130A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04A50678 push dword ptr [edx+14h]; ret	5_2_04A507CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04A506C0 push dword ptr [edx+14h]; ret	5_2_04A507CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04A50691 push dword ptr [edx+14h]; ret	5_2_04A507CD
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00000236024465EE push 8B48D233h; iretd	6_2_00000236024465F3
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000002360243433F push eax; ret	6_2_0000023602434351
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D365EE push 8B48D233h; iretd	7_2_0000023538D365F3
Source: C:\Windows\System32\wermgr.exe	Code function: 7_2_0000023538D2433F push eax; ret	7_2_0000023538D24351
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04FA1151 push 82D6EFF1h; retn B17Eh	12_2_04FA130A
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE433F push eax; ret	14_2_0000024B66AE4351
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AF65EE push 8B48D233h; iretd	14_2_0000024B66AF65F3

Source: C:\Windows\System32\wermgr.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Delayed program exit found

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04A80B52 Sleep,ExitProcess,	5_2_04A80B52
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_034E0A85 Sleep,ExitProcess,	12_2_034E0A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_034E0B52 Sleep,ExitProcess,	12_2_034E0B52

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Show sources

Source: C:\Windows\System32\wermgr.exe	Function Chain: threadCreated,threadDelayed,threadDelayed,threadDelayed,userTimerSet,threadDelayed,fileVolumeQueried,languageOrLocalQueried,languageOrLocalQueried,adjustToken,systemQueried,systemQueried,threadDelayed,threadDelayed,threadDelayed,mutantCreated,threadInformationSet,threadInformationSet,threadInformationSet,threadInformationSet,threadDelayed,threadDelayed
Source: C:\Windows\System32\wermgr.exe	Function Chain: threadCreated,threadDelayed,threadDelayed,threadDelayed,userTimerSet,threadDelayed,fileVolumeQueried,languageOrLocalQueried,languageOrLocalQueried,adjustToken,systemQueried,systemQueried,threadDelayed,threadDelayed,threadDelayed,mutantCreated,threadInformationSet,threadInformationSet,threadInformationSet,threadInformationSet,threadDelayed
Source: C:\Windows\System32\wermgr.exe	Function Chain: threadCreated,threadDelayed,threadDelayed,threadDelayed,userTimerSet,threadDelayed,fileVolumeQueried,languageOrLocalQueried,languageOrLocalQueried,adjustToken,systemQueried,systemQueried,threadDelayed,threadDelayed,threadDelayed,mutantCreated,threadInformationSet,threadInformationSet,threadInformationSet,threadInformationSet,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\System32\wermgr.exe	RDTSC instruction interceptor: First address: 000002360244E610 second address: 000002360244E610 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 ret 0x0000000a dec esp 0x0000000b mov edi, eax 0x0000000d call dword ptr [0000AE5Eh] 0x00000013 mov ecx, 7FFE0320h 0x00000018 dec eax 0x00000019 mov ecx, dword ptr [ecx] 0x0000001b mov eax, dword ptr [7FFE0004h] 0x00000022 dec eax 0x00000023 imul eax, ecx 0x00000026 dec eax 0x00000027 shr eax, 18h 0x0000002a ret 0x0000002b inc esp 0x0000002c mov esi, eax 0x0000002e dec ecx 0x0000002f mov eax, edi 0x00000031 dec eax 0x00000032 not eax 0x00000034 dec eax 0x00000035 mov ebx, 6CEE0E00h 0x0000003a xor edx, edx 0x0000003c inc ecx 0x0000003d xchg byte ptr [eax+0Bh], cl 0x00000040 fmul dword ptr [ebx-17280808h]
Source: C:\Windows\System32\wermgr.exe	RDTSC instruction interceptor: First address: 0000023538D3E610 second address: 0000023538D3E610 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 ret 0x0000000a dec esp 0x0000000b mov edi, eax 0x0000000d call dword ptr [0000AE5Eh] 0x00000013 mov ecx, 7FFE0320h 0x00000018 dec eax 0x00000019 mov ecx, dword ptr [ecx] 0x0000001b mov eax, dword ptr [7FFE0004h] 0x00000022 dec eax 0x00000023 imul eax, ecx 0x00000026 dec eax 0x00000027 shr eax, 18h 0x0000002a ret 0x0000002b inc esp 0x0000002c mov esi, eax 0x0000002e dec ecx 0x0000002f mov eax, edi 0x00000031 dec eax 0x00000032 not eax 0x00000034 dec eax 0x00000035 mov ebx, 6CEE0E00h 0x0000003a xor edx, edx 0x0000003c inc ecx 0x0000003d xchg byte ptr [eax+0Bh], cl 0x00000040 fmul dword ptr [ebx-17280808h]
Source: C:\Windows\System32\wermgr.exe	RDTSC instruction interceptor: First address: 0000024B66AFE610 second address: 0000024B66AFE610 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 ret 0x0000000a dec esp 0x0000000b mov edi, eax 0x0000000d call dword ptr [0000AE5Eh] 0x00000013 mov ecx, 7FFE0320h 0x00000018 dec eax 0x00000019 mov ecx, dword ptr [ecx] 0x0000001b mov eax, dword ptr [7FFE0004h] 0x00000022 dec eax 0x00000023 imul eax, ecx 0x00000026 dec eax 0x00000027 shr eax, 18h 0x0000002a ret 0x0000002b inc esp 0x0000002c mov esi, eax 0x0000002e dec ecx 0x0000002f mov eax, edi 0x00000031 dec eax 0x00000032 not eax 0x00000034 dec eax 0x00000035 mov ebx, 6CEE0E00h 0x0000003a xor edx, edx 0x0000003c inc ecx 0x0000003d xchg byte ptr [eax+0Bh], cl 0x00000040 fmul dword ptr [ebx-17280808h]

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_000002360244E610 rdtsc

6_2_000002360244E610

Source: C:\Windows\System32\wermgr.exe	Code function: GetAdaptersInfo,RtlDeleteBoundaryDescriptor,	6_2_000002360243A940
Source: C:\Windows\System32\wermgr.exe	Code function: GetAdaptersInfo,RtlDeleteBoundaryDescriptor,	7_2_0000023538D2A940
Source: C:\Windows\System32\wermgr.exe	Code function: GetAdaptersInfo,	14_2_0000024B66AEA940

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed

Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AE4800 FindFirstFileW,		14_2_0000024B66AE4800
Source: C:\Windows\System32\wermgr.exe	Code function: 14_2_0000024B66AEAC30 FindFirstFileW,FindNextFileW,		14_2_0000024B66AEAC30

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 49264	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 37614	Jump to behavior

Source: WerFault.exe, 0000000B.00000003.270706326.0000000004D50000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll val="332" />
Source: WerFault.exe, 0000000B.00000002.281862143.0000000004D4D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW8
Source: WerFault.exe, 00000011.00000002.328729851.000000000342A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW(XC
Source: WerFault.exe, 0000000B.00000002.282417337.00000000050D0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.288893959.00000000051B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.329359308.0000000005250000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000B.00000002.280049580.0000000004CEC000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWO
Source: wermgr.exe, 00000007.00000002.637307214.0000023538F21000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWP
Source: wermgr.exe, 00000007.00000002.637901785.0000023538F7E000.00000004.00000020.sdmp, WerFault.exe, 0000000B.00000002.280049580.0000000004CEC000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000002.287180204.00000000050D2000.00000004.00000001.sdmp, wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000002.329318833.0000000005212000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: wermgr.exe, 0000000E.00000002.644986028.0000024B66C78000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW -
Source: WerFault.exe, 0000000B.00000002.282417337.00000000050D0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.288893959.00000000051B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.329359308.0000000005250000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000B.00000002.282417337.00000000050D0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.288893959.00000000051B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.329359308.0000000005250000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: wermgr.exe, 00000006.00000002.639226277.0000023602560000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WerFault.exe, 0000000B.00000002.282417337.00000000050D0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.288893959.00000000051B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.329359308.0000000005250000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_000002360244E610 rdtsc

6_2_000002360244E610

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6DD69660 LdrInitializeThunk,

4_2_6DD69660

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6DD321C0 StartW,VirtualAlloc,VirtualFree,LoadLibraryA,GetProcAddress,

4_2_6DD321C0

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\wermgr.exe base: 23602430000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\wermgr.exe base: 23538D20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\wermgr.exe base: 24B66AE0000 protect: page execute and read and write	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 23602430000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 7FF662B52860	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 23538D20000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 7FF662B52860	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 24B66AE0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 7FF662B52860	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior

Source: wermgr.exe, 00000006.00000002.639897414.0000023602B10000.00000002.00000001.sdmp, wermgr.exe, 00000007.00000002.638088186.00000235394F0000.00000002.00000001.sdmp, wermgr.exe, 0000000E.00000002.645834474.0000024B67300000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: wermgr.exe, 00000006.00000002.639897414.0000023602B10000.00000002.00000001.sdmp, wermgr.exe, 00000007.00000002.638088186.00000235394F0000.00000002.00000001.sdmp, wermgr.exe, 0000000E.00000002.645834474.0000024B67300000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: wermgr.exe, 00000006.00000002.639897414.0000023602B10000.00000002.00000001.sdmp, wermgr.exe, 00000007.00000002.638088186.00000235394F0000.00000002.00000001.sdmp, wermgr.exe, 0000000E.00000002.645834474.0000024B67300000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: wermgr.exe, 00000006.00000002.639897414.0000023602B10000.00000002.00000001.sdmp, wermgr.exe, 00000007.00000002.638088186.00000235394F0000.00000002.00000001.sdmp, wermgr.exe, 0000000E.00000002.645834474.0000024B67300000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: wermgr.exe, 00000006.00000002.639897414.0000023602B10000.00000002.00000001.sdmp, wermgr.exe, 00000007.00000002.638088186.00000235394F0000.00000002.00000001.sdmp, wermgr.exe, 0000000E.00000002.645834474.0000024B67300000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Stealing of Sensitive Information:

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 6380, type: MEMORY

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.368401033.0000000004B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.358957054.0000000004FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.316290050.0000000000C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.301654688.0000000000BB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.345834553.00000000032B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.342880872.00000000047F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.330027529.0000000003410000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.330091629.00000000034B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.4b00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4b00000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4fa0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.3410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.47f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4fa0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.47f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.bb0000.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 6380, type: MEMORY

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.368401033.0000000004B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.358957054.0000000004FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.316290050.0000000000C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.301654688.0000000000BB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.345834553.00000000032B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.342880872.00000000047F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.330027529.0000000003410000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.330091629.00000000034B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.4b00000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4b00000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4fa0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.3410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.47f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4fa0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.47f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.bb0000.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API11	Path Interception	Access Token Manipulation1	Disable or Modify Tools1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection212	Virtualization/Sandbox Evasion11	LSASS Memory	Security Software Discovery121	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Access Token Manipulation1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection212	NTDS	Virtualization/Sandbox Evasion11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	System Network Configuration Discovery11	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery112	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.rundll32.exe.4b00000.3.unpack	100%	Avira	HEUR/AGEN.1138157	Download File
4.2.rundll32.exe.47f0000.3.unpack	100%	Avira	HEUR/AGEN.1138157	Download File
12.2.rundll32.exe.4fa0000.3.unpack	100%	Avira	HEUR/AGEN.1138157	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/5/kps/	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.01BBF31298B77829737BB7961939977F/5/kps/~	0%	Avira URL Cloud	safe
https://117.252.68.211/viderk	0%	Avira URL Cloud	safe
https://117.252.68.211/	0%	Avira URL Cloud	safe
https://117.252.68.211/I	0%	Avira URL Cloud	safe
https://117.252.68.211/derMHZ:2	0%	Avira URL Cloud	safe
https://117.252.68.211/videro	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/0/Windows%2010%20x64/1	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/EW	0%	Avira URL Cloud	safe
https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/user/user/0/	0%	Avira URL Cloud	safe
https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/Q	0%	Avira URL Cloud	safe
http://crl.mm	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029///0/	0%	Avira URL Cloud	safe
https://117.252.68.211/rguH2:(	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/$	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/w	0%	Avira URL Cloud	safe
https://117.252.68.211/der	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.01BBF31298B77829737BB7961939977F/5/kps/	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/path/C:%5CUsers%5Ca	0%	Avira URL Cloud	safe
https://watson.telemet	0%	URL Reputation	safe
https://watson.telemet	0%	URL Reputation	safe
https://watson.telemet	0%	URL Reputation	safe
https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/user/user/0/T	0%	Avira URL Cloud	safe
https://117.252.68.211/vider	0%	Avira URL Cloud	safe
https://watson.telemetpinfo.io/	0%	Avira URL Cloud	safe
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ident.me	176.58.123.25	true	false	unknown
ipinfo.io	216.239.32.21	true	false	high
3.52.17.84.cbl.abuseat.org	127.0.0.2	true	false	high
3.52.17.84.zen.spamhaus.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ipinfo.io/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/5/kps/	wermgr.exe, 0000000E.00000002.645446388.0000024B66CD5000.00000004.00000020.sdmp, wermgr.exe, 0000000E.00000002.644986028.0000024B66C78000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.01BBF31298B77829737BB7961939977F/5/kps/~	wermgr.exe, 00000007.00000002.637307214.0000023538F21000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/viderk	wermgr.exe, 00000007.00000002.637461915.0000023538F3C000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/	wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/I	wermgr.exe, 0000000E.00000002.644986028.0000024B66C78000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/derMHZ:2	wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/videro	wermgr.exe, 00000007.00000002.637461915.0000023538F3C000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://ipinfo.io:80/ip	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false		high
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/0/Windows%2010%20x64/1	wermgr.exe, 0000000E.00000002.645516304.0000024B66CDA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/EW	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/user/user/0/	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/Q	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mm	WerFault.exe, 00000011.00000002.329242454.0000000005150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029///0/	wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/rguH2:(	wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/$	wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/w	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/der	wermgr.exe, 0000000E.00000002.635627648.0000024B00055000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.01BBF31298B77829737BB7961939977F/5/kps/	wermgr.exe, 00000007.00000002.637747793.0000023538F6E000.00000004.00000020.sdmp, wermgr.exe, 00000007.00000002.637307214.0000023538F21000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/path/C:%5CUsers%5Ca	wermgr.exe, 0000000E.00000002.645516304.0000024B66CDA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://watson.telemet	wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://117.252.68.211:443/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/DNSBL/listed/0/	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/14/user/user/0/T	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/vider	wermgr.exe, 00000007.00000002.637461915.0000023538F3C000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://watson.telemetpinfo.io/	wermgr.exe, 0000000E.00000002.636931274.0000024B000C7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://117.252.68.211/che7/066656_W10017134.9E37716DC9BB3F4BF1D83E6BCFD1DB93/23/2000029/	wermgr.exe, 0000000E.00000002.635264188.0000024B00000000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.239.32.21	ipinfo.io	United States		15169	GOOGLEUS	false
117.252.68.211	unknown	India		9829	BSNL-NIBNationalInternetBackboneIN	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	399327
Start date:	28.04.2021
Start time:	17:07:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winDLL@18/14@6/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 16.4% (good quality ratio 14.3%) Quality average: 67% Quality standard deviation: 37.6%
HCA Information:	Successful, ratio: 97% Number of executed functions: 40 Number of non-executed functions: 37
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 20.82.210.154, 13.64.90.137, 40.88.32.150, 184.30.20.56, 8.241.78.126, 8.241.82.254, 8.241.90.254, 8.241.89.254, 8.238.27.126, 52.255.188.83, 2.20.142.210, 2.20.142.209, 92.122.145.220 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, dual-a-0001.dc-msedge.net, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ident.me	MTCC169.DLL	Get hash	malicious	Browse	176.58.123.25
	frox0cheats.exe	Get hash	malicious	Browse	176.58.123.25
	DETAILS_1494442031_248183307.xlsm	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Heur.5671.xls	Get hash	malicious	Browse	176.58.123.25
	10.dll	Get hash	malicious	Browse	176.58.123.25
	Upload_1624615171_1216115197.xls	Get hash	malicious	Browse	176.58.123.25
	Upload_1672782307_1135693836.xls	Get hash	malicious	Browse	176.58.123.25
	Att_432126117_2131008625.xls	Get hash	malicious	Browse	176.58.123.25
	OzRW6h38aL.dll	Get hash	malicious	Browse	176.58.123.25
	Attach_356001541_2141808015.xls	Get hash	malicious	Browse	176.58.123.25
	Sign-1870635479_637332644.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Exploit.Siggen3.10350.14349.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse	176.58.123.25
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Heur.22173.xls	Get hash	malicious	Browse	176.58.123.25
	Sign_1229872171-1113140666(1).xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Exploit.Siggen3.10048.24657.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Exploit.Siggen3.10048.15397.xls	Get hash	malicious	Browse	176.58.123.25

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
BSNL-NIBNationalInternetBackboneIN	JRyLnlTR1O	Get hash	malicious	Browse	117.222.196.212
	MGuvcs6Ocz	Get hash	malicious	Browse	117.213.41.118
	SecuriteInfo.com.Trojan.GenericKD.36426529.10317.dll	Get hash	malicious	Browse	117.210.210.179
	SecuriteInfo.com.Exploit.Siggen3.14843.27490.xls	Get hash	malicious	Browse	117.210.210.179
	SecuriteInfo.com.Exploit.Siggen3.10089.3000.xls	Get hash	malicious	Browse	117.212.193.62
	DocuSign_167.xls	Get hash	malicious	Browse	117.212.193.62
	pNadrQriqg.exe	Get hash	malicious	Browse	117.212.193.62
	DmGtMcOds3.exe	Get hash	malicious	Browse	117.212.193.62
	wtROGJDiTf.exe	Get hash	malicious	Browse	117.212.193.62
	wl0mBiXkW1.exe	Get hash	malicious	Browse	117.212.193.62
	opgVccK0a8.exe	Get hash	malicious	Browse	117.212.193.62
	bdoVxDz0iK.exe	Get hash	malicious	Browse	117.212.193.62
	KNJ725Xas2.exe	Get hash	malicious	Browse	117.212.193.62
	eDwrLWqVGL.exe	Get hash	malicious	Browse	117.212.193.62
	yVn2ywuhEC.exe	Get hash	malicious	Browse	59.97.170.49
	i	Get hash	malicious	Browse	117.202.65.25
	Mozi.m	Get hash	malicious	Browse	117.215.212.106
	vJHWQgfJ23.exe	Get hash	malicious	Browse	117.222.63.100
	malware1.exe	Get hash	malicious	Browse	117.224.181.152
	bdOPjE89ck.dll	Get hash	malicious	Browse	117.242.212.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
8916410db85077a5460817142dcbc8de	huqgk.exe	Get hash	malicious	Browse	117.252.68.211
	publiclicense.vbs	Get hash	malicious	Browse	117.252.68.211
	Ei8IYTWG2j.exe	Get hash	malicious	Browse	117.252.68.211
	IU7lKa778w.exe	Get hash	malicious	Browse	117.252.68.211
	oi5zrjsKJG.exe	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.RiskTool.Win32.BitCoinMiner.vho.31244.exe	Get hash	malicious	Browse	117.252.68.211
	b49zEBfIlL.dll	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.UDS.Trojan.Win32.Injuke.25486.exe	Get hash	malicious	Browse	117.252.68.211
	XLhw6JGwC0.dll	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.UDS.Trojan.Win32.Bsymem.19574.dll	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.Program.Win32.Wacapew.Cml.8809.exe	Get hash	malicious	Browse	117.252.68.211
	ai8HRya7D6.exe	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.FileRepMalware.16835.exe	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.generic.ml.17984.exe	Get hash	malicious	Browse	117.252.68.211
	T22JACdQvB.exe	Get hash	malicious	Browse	117.252.68.211
	cD1m0MfljP.exe	Get hash	malicious	Browse	117.252.68.211
	GwmwZSGYgr.exe	Get hash	malicious	Browse	117.252.68.211
	SecuriteInfo.com.Variant.Zusy.371743.25402.dll	Get hash	malicious	Browse	117.252.68.211
	fkt.exe	Get hash	malicious	Browse	117.252.68.211
	pQMXe7p8Iw.exe	Get hash	malicious	Browse	117.252.68.211

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_69688d2812e06195cef530d1f4e704d7e967697_82810a17_188e90d8\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12022
Entropy (8bit):	3.777335867200176
Encrypted:	false
SSDEEP:	192:t9XBim0oXDHBUZMX4jed+H/u7sUS274It7c+:nXBiAXDBUZMX4jeq/u7sUX4It7c+
MD5:	9FFF3572AB97E08BFA6AC2D24EAC383F
SHA1:	09978D3F2620624380F5D76188ED6D6F9416D324
SHA-256:	C84624D148F834B7D849D5732ACFD75244E9B405462564BBCBE3F0910CB19810
SHA-512:	5DDE669EEDFB998904220C30FB32E77CAA3CC8A4728F3FDB00F11BC1AC408A09BEAE5E59B8F3BC64F7EFA22537BAD33507BF29850A2B68772835D1B0AE6B7DCD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.4.1.2.8.4.8.2.1.1.6.6.2.6.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.4.1.2.8.4.9.0.0.2.2.8.7.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.6.3.a.2.9.e.-.2.1.4.7.-.4.2.9.6.-.8.9.d.5.-.2.e.4.a.7.5.2.e.3.5.b.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.a.a.f.0.9.9.-.5.f.d.1.-.4.d.6.7.-.a.c.2.5.-.e.0.8.5.2.1.f.b.c.2.b.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.a.c.-.0.0.0.1.-.0.0.1.6.-.d.f.5.5.-.8.7.b.4.8.b.3.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_69688d2812e06195cef530d1f4e704d7e967697_82810a17_18fea0a7\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12020
Entropy (8bit):	3.7778633723964874
Encrypted:	false
SSDEEP:	192:0p5iU0oXTHBUZMX4jed+H/u7sUS274It7ct:siiXTBUZMX4jeq/u7sUX4It7ct
MD5:	842113DBB3213203E38CFB4DB0DEA028
SHA1:	2DEEB2F0D95D006B953C627E7910703F555B2D98
SHA-256:	DFCE9486F826F1D19D09AB2DBD0924BE6C026887BD8B4401EB99C43F6212AC3A
SHA-512:	0399EDB53C6E73E6DB0DE0D762818B77A6FAF0D3C2EE0761634109A45805036A78F077B5196E9CE7E74A8AB1C55C1F20784750E6F40BF554E274225FE89D7C7B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.4.1.2.8.4.8.2.5.0.7.2.5.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.4.1.2.8.4.9.3.4.6.0.3.6.7.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.9.2.1.d.b.5.-.a.e.2.5.-.4.3.8.c.-.8.7.5.3.-.6.e.d.f.a.d.2.b.7.7.5.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.0.5.6.3.4.0.-.c.1.6.c.-.4.3.e.6.-.b.d.5.e.-.3.7.6.1.6.e.b.f.2.e.8.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.2.c.-.0.0.0.1.-.0.0.1.6.-.3.2.d.2.-.8.a.b.4.8.b.3.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_69688d2812e06195cef530d1f4e704d7e967697_82810a17_196eee0b\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12022
Entropy (8bit):	3.777635997193173
Encrypted:	false
SSDEEP:	192:Bogic0oXLHBUZMX4jed+H/u7svS274It7c/:qgi6XrBUZMX4jeq/u7svX4It7c/
MD5:	386FAB2ABCCD41ABE0F3B8E45351339D
SHA1:	BDE4A9774F1BDB5D4F54BE292AE5B2D94C8FB226
SHA-256:	05153ABE1D13AC27E807AE85B10A9BDB8A368EB86423EEDB867B67996D04EC71
SHA-512:	332CDC437380DC2BDB842F281D4387C9D994C24DAB39660FCA67214F4C96DFC324F38B106792B7D6AEC7B27F20E158BB90E5B2C4660B309C95E54C53CAEE014B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.4.1.2.8.4.8.4.2.2.6.0.0.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.4.1.2.8.5.1.3.1.7.9.1.0.1.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.8.a.3.7.7.f.-.5.f.f.c.-.4.c.f.5.-.a.3.7.a.-.d.e.7.c.e.f.5.b.f.8.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.4.8.7.8.1.d.3.-.e.e.5.4.-.4.1.5.a.-.b.5.9.e.-.7.3.1.5.8.d.c.9.8.8.a.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.b.8.-.0.0.0.1.-.0.0.1.6.-.3.d.6.e.-.7.9.b.6.8.b.3.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER63EC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 29 00:08:03 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	67658
Entropy (8bit):	1.6479708343690704
Encrypted:	false
SSDEEP:	192:s8xld5wuChYvoSTCkA/htQ5XAPICExIjeqiUikVcRkpM4EgPhn8:Pxld3ChYgpJ/bs+ICEOi+iMOkpMzIh8
MD5:	5144A9413BBA0CAE623F9024E5692C06
SHA1:	68FEFCC45DCD98C0C7AB98A06B58A1378CD2A962
SHA-256:	2CC055E3C53390D86719CC1D94925571830775AD4F582302DA2F7D49CBC24B80
SHA-512:	DE5C68DF5D38782E8EF390C100D2C24DF25590185E063589EF28770F02B43A6BD936970470E035508D220EDAEC7DD7AFBE883F303976F7B43904FCA0FEE66801
Malicious:	false
Preview:	MDMP....... ..........`...................U...........B...... .......GenuineIntelW...........T..............`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6573.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 29 00:08:04 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	68618
Entropy (8bit):	1.6599488969509846
Encrypted:	false
SSDEEP:	192:SmTlrCgZ3svG8IjeqiUikVt+kUnJTftiJQcK1n4c:b5mgZcvWi+iMtCJTftUw4c
MD5:	CCEC2014F90E39B0FD9298B1C16AC707
SHA1:	DFE9177E6433065BFBA713DCEAAE0471DFC6A5DD
SHA-256:	FCB69806E42E6C7BE30E8EAB576F3A7ABFDF1FCC6BDA86AE9B5EB4ED189D8716
SHA-512:	5C63727FF5F978E8E61821B708B8A0EE8BF3DEC57AA3871BD85F554F5682A0D6194866673EB0905E3E2E96225FAA3B711A5A517497C836B6DAD710EC0F66FBD5
Malicious:	false
Preview:	MDMP....... ..........`...................U...........B...... .......GenuineIntelW...........T.......,......`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6AC3.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.69570843444687
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi6D6Pes6YX162gmf8dS4CprQ89bAnTsfxnAm:RrlsNi+6Pes6Yl62gmf8dStAn4fxl
MD5:	E86C23DD9AB7CF965EE4BE61873D3EBF
SHA1:	CBCC377A81BD623AD8287EAD4C7D7150882EA6A8
SHA-256:	19A5DC5BA30386720580BAB19669F61055D31C1C916FA472ECDC3CF8AB70DC86
SHA-512:	3EC6EA1A40195732D0FFC9616A2D0D5D5467F627A81216B6770EA61F00A97C9AB4CCFFE014AC23056BBC5325B2D7C763836906AFE10C10F4C17F2B5FE7AECB26
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.1.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C29.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 29 00:08:07 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	67678
Entropy (8bit):	1.6851785096659588
Encrypted:	false
SSDEEP:	192:90PUnFo5eYZI68n967sgIjeqiUikVFzF8M6M1U//nJ:iP/UYG9Egi+iMVF8M69//J
MD5:	31DCDC052C2C02FCAD819E734DBAD318
SHA1:	C89EE77266B42299549B28D86BEE23EBD545A7F0
SHA-256:	4D43D8D7167E0C653E612621F8A395F3B6AFE2B7F42B57AB6CE6C753594084B8
SHA-512:	B8AB7887D19331BF1B7A45E775E3D20A468E6B00CD672B685B4C3BA3E17E6C29A7C2D31C6CE47C8F3B90330701EFBDD2D6E008094B9F75E4C8A2ABCDA140C0AC
Malicious:	false
Preview:	MDMP....... ..........`...................U...........B...... .......GenuineIntelW...........T..............`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D44.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8358
Entropy (8bit):	3.6963563878911425
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiMTs6CX5Xo6YSV63gmf8dS4CprFq89bAnisfZCAm:RrlsNiMY6CJ46Yg63gmf8dSRAnhfZ0
MD5:	46F1EBE12628221CBDCC3564EA41F1DF
SHA1:	B70F04040843FEB1EE9D1D7F275C2863D33290A0
SHA-256:	6A7397EA241681C8D636D3A652DE73AA2D1EEFFAC1565AFF1631C0F90E6DA6DA
SHA-512:	A243B3565BAD7FD604B11CB6A5F64859D5A5EE277572DB15CF2CC25BF88923F669EB318B93CFE3A47B051311834E6807B1FFBC1639EFC9171A78597BC465DF6E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.6.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DB2.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	4.485901687905486
Encrypted:	false
SSDEEP:	48:cvIwSD8zsDJgtWI9OgWSC8B98fm8M4JCdsjMFRP+q8vjsj74SrSsad:uITfdhZSNcJJGPKO7DWPd
MD5:	C150636EE7137591E56D7E4A525090E7
SHA1:	33550A6028EF4F4FD2BDB80B40074D5F21FFE0E7
SHA-256:	D5E4D2A5120B3AB302E68A13A3309770CFA6E734B28A8FC3BA604CA91CC27658
SHA-512:	84C334FFBDBE22C3D5777E7674994A54D25AEF94FB98C4EE94B78268606E05E50E1E48F1B4381B70F0E2CB0B4D1333D7A6296CD6543F51D408EE12845CC62E48
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="966798" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70A0.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	4.485313250774103
Encrypted:	false
SSDEEP:	48:cvIwSD8zsDJgtWI9OgWSC8Bo8fm8M4JCdsjMFu+q8vjsjF4SrS0d:uITfdhZSNLJJvKOFDW0d
MD5:	73F6D868CF7E1C56F1ECFECFA428BF03
SHA1:	3D5C17DFC539330EC2E2FBF22CE02FC9F5DBD97C
SHA-256:	D04FBCFD538200D6FD6BFFDEE222E002E60D049C37CBFCB4F25AECB8465B081F
SHA-512:	A3D7FF7E902B44CA4192D5FD5CEDC0B3AAD1F20D765B11F0C0AAC82B0A93306B1B71166CC009C2BD262B2FCB0CAEDD2DFED17CD21E9058425B76CF81A1ADDC3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="966798" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER787F.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8364
Entropy (8bit):	3.69610550835962
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiKj56VWL6YXPo62gmf8dS4Cprx89bHb8sfNtjm:RrlsNiI6VWL6Yg62gmf8dSeHbPf36
MD5:	DBEFE80B11BE193217783F870869FFF1
SHA1:	DB20688898F5A1EB3A4FDC8A8CF143DA06AAB010
SHA-256:	7D9C7FB03E110961F8E03A503C0FBE71121DC4FF8CB70673869E5828EC6FECD6
SHA-512:	ECE13E21DC74D5CA3BF711A72E5C90A2AF6BA04C9B2962C4C94A74D70A6F7FAA05EF4C2613525F58BC73CE68B0643EF47162D004FC421BB97AD58DF0C2A064E1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.2.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C68.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	4.48628973062307
Encrypted:	false
SSDEEP:	48:cvIwSD8zsDJgtWI9OgWSC8BI8fm8M4JCdsjMFio+q8vjsjr4SrSAd:uITfdhZSNnJJ7oKOrDWAd
MD5:	427DF268236865246DCF50AF4C20E03B
SHA1:	F563EC2C0330E7A45B588BF7173C80A2AD52AAF9
SHA-256:	BEEADE399CF1B212531CA1D3C024722DB9B3796AB08CC5B3646F5C5738B43CFF
SHA-512:	0D20975D3334B626117876C3B5603B9BF54AEE7009E4C9468CA3B91DD436ECA90B16AC1CDF8F923FA6BCFE4C1163F782055B6892F84D187802C329CCBA62FE5C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="966798" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	Microsoft Cabinet archive data, 58596 bytes, 1 file
Category:	dropped
Size (bytes):	58596
Entropy (8bit):	7.995478615012125
Encrypted:	true
SSDEEP:	1536:J7r25qSSheImS2zyCvg3nB/QPsBbgwYkGrLMQ:F2qSSwIm1m/QEBbgb1oQ
MD5:	61A03D15CF62612F50B74867090DBE79
SHA1:	15228F34067B4B107E917BEBAF17CC7C3C1280A8
SHA-256:	F9E23DC21553DAA34C6EB778CD262831E466CE794F4BEA48150E8D70D3E6AF6D
SHA-512:	5FECE89CCBBF994E4F1E3EF89A502F25A72F359D445C034682758D26F01D9F3AA20A43010B9A87F2687DA7BA201476922AA46D4906D442D56EB59B2B881259D3
Malicious:	false
Preview:	MSCF............,...................I........T........bR. .authroot.stl...s~.4..CK..8T....c_.d....A.K......&.-.J...."Y...$E.KB..D...D.....3.n..u.............\|..=H4..c&.......f.,..=..-....p2.:..`HX......b.......Di.a......M.....4.....i..}..:~N.<..>..V..CX......B......,.q.M.....HB..E~Q...)..Gax../..}7..f......O0...x..k..ha...y.K.0.h..(....{2Y.].g...yw..\|0.+?.`-../.xvy..e......w.+^...w\|.Q.k.9&.Q.EzS.f......>?w.G.......v.F......A......-P.$.Y...u....Z..g..>.0&.y.(..<.].`>... ..R.q...g.Y..s.y.B..B....Z.4.<?.R....1.8.<.=.8..[a.s.......add..).NtX....r....R.&W4.5]....k.._iK..xzW.w.M.>,5.}..}.tLX5Ls3_..).!..X.~...%.B.....YS9m.,.....BV`.Cee.....?......:.x-.q9j...Yps..W...1.A<.X.O....7.ei..a\.~=X....HN.#....h,....y...\.br.8.y"k).....~B..v....GR.g\|.z..+.D8.m..F .h............ItNs.\....s..,.f`D...]..k...:9..lk.<D....u...........[...*.wY.O....P?.U.l....Fc.ObLq......Fvk..G9.8..!..\T:K`.......'.3......;.u..h...uD..^.bS...r........j..j .=...s .FxV....g.c.s..9.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.123116142976021
Encrypted:	false
SSDEEP:	6:kKBWswTJ0N+SkQlPlEGYRMY9z+4KlDA3RUe0ht:JWswTJrkPlE99SNxAhUe0ht
MD5:	8B4156767ABA54BC9C1394B5F8AD2D27
SHA1:	10EA671DF8B8D84E1B7214A7500BE25C27020711
SHA-256:	3BEF1A9573DFC9BE29E81AD609CE17CEC5C2258DB8EDD5B59A0096D90EE9E723
SHA-512:	7039B1B078B7D3D374763F6F509DDB40F5F76936ABB33B7FCCBCF099EB65388A61FB68235EAD01E01D5FB435A4D6062ECD368D6A9FD9A0CC8AFBE13906E10D7E
Malicious:	false
Preview:	p...... .........L..<..(....................................................... ...................$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.8.f.4.f.3.f.6.f.d.7.1.:.0."...

Static File Info

General
File type:	PE32 executable (DLL) (native) Intel 80386, for MS Windows
Entropy (8bit):	6.606098630665599
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.43% Win32 Device Driver (generic) (12004/3) 1.18% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll
File size:	1375832
MD5:	526bd61e387de23722e171a34dcd7016
SHA1:	9007dece802951a0f29c9ab84085e7d1920099f6
SHA256:	7d35c3abef65ed1d81d2f70944db31ba2a8cc703f1ccf8b82ca7b3929b8233e1
SHA512:	9c4ef33c8084b928fff5025b6c3045c9fdea3289e7e71206a9ef6e77496f9758cc4ba123182a32b4518708259df99818429f31172e6b19f8d87a6b4dd0bde2b8
SSDEEP:	12288:ipb7Lvt5N5xg+KXHXp6p5mNISQlHH/u+lQd2arxszWrHP+4ktXk0K+QPQNc:ipb7Lvt5N5xg2qd2UPSy0ePp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................Rich....................PE..L......`...........!.....D.................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10001000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	native
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6087BC1F [Tue Apr 27 07:24:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	dd7a9fcfd98a20212beef73d23eba6f9

Entrypoint Preview

Instruction
push ebp
push ebx
push edi
push esi
sub esp, 54h
mov eax, dword ptr [10151088h]
mov ecx, dword ptr [10151084h]
lea edx, dword ptr [eax-01h]
imul edx, eax
xor eax, eax
dec eax
xor edx, eax
or edx, FFFFFFFEh
cmp edx, eax
mov eax, ACFFF8E6h
sete byte ptr [esp+15h]
cmp ecx, 0Ah
setl byte ptr [esp+16h]
cmp eax, 2E7BAD0Ch
jnle 00007F56B8BDA07Eh
cmp eax, 9D42655Dh
je 00007F56B8BDA099h
cmp eax, ACFFF8E6h
je 00007F56B8BDA0DAh
cmp eax, F5808584h
jne 00007F56B8BDA046h
mov eax, 9D42655Dh
jmp 00007F56B8BDA03Fh
cmp eax, 2E7BAD0Dh
je 00007F56B8BDA0EFh
cmp eax, 6E84CF46h
je 00007F56B8BDA92Eh
cmp eax, 7A073C9Eh
jne 00007F56B8BDA022h
jmp 00007F56B8BDB19Fh
mov eax, dword ptr [10151088h]
cmp dword ptr [esp+6Ch], 01h
mov esi, 6E84CF46h
mov edi, F5808584h
lea ecx, dword ptr [eax-01h]
sete byte ptr [esp+17h]
imul ecx, eax
mov eax, ecx
xor eax, FFFFFFFEh
test eax, ecx
mov eax, F5808584h
sete cl
cmove eax, esi
cmp dword ptr [10151084h], 0Ah
setl dl
cmovnl eax, edi
xor dl, cl
cmovne eax, esi
jmp 00007F56B8BD9FD8h
mov cl, byte ptr [esp+15h]
mov al, byte ptr [esp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x14c040	0x44	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14c154	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x152000	0x1018	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14c020	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe6000	0x20	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe42c2	0xe4400	False	0.118341619318	data	6.67783430633	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xe6000	0x661de	0x66200	False	0.710566956089	data	5.45913192024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14d000	0x408c	0x4200	False	0.697502367424	data	5.36135767092	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x152000	0x1018	0x1200	False	0.619574652778	data	5.20239315796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	VirtualFree, LoadLibraryA, GetProcAddress, VirtualAlloc

Exports

Name	Ordinal	Address
StartW	1	0x100021c0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 17:08:22.734883070 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:23.190110922 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:08:23.190352917 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:23.220391989 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:23.702476978 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:08:23.753757000 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:08:23.789621115 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:24.251329899 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:08:24.402605057 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:57.346214056 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:57.958123922 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:08:58.118437052 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:08:58.217983961 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:58.993257999 CEST	49716	80	192.168.2.5	216.239.32.21
Apr 28, 2021 17:08:59.037867069 CEST	80	49716	216.239.32.21	192.168.2.5
Apr 28, 2021 17:08:59.038062096 CEST	49716	80	192.168.2.5	216.239.32.21
Apr 28, 2021 17:08:59.043179989 CEST	49716	80	192.168.2.5	216.239.32.21
Apr 28, 2021 17:08:59.084278107 CEST	80	49716	216.239.32.21	192.168.2.5
Apr 28, 2021 17:08:59.200871944 CEST	80	49716	216.239.32.21	192.168.2.5
Apr 28, 2021 17:08:59.281435966 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:08:59.405586958 CEST	49716	80	192.168.2.5	216.239.32.21
Apr 28, 2021 17:08:59.751532078 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:00.111414909 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:00.111534119 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:00.111617088 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:00.111643076 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:00.800528049 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:01.271193981 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:01.508316994 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:01.626394987 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:02.084266901 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:02.399158955 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:02.454257011 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:02.937129974 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:03.178805113 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:03.405844927 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:03.449820995 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:09:04.036609888 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:04.162647009 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:09:04.218492985 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:10:09.188874960 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:10:09.188903093 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:10:09.189481020 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:10:09.212331057 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:10:09.212379932 CEST	49712	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:10:09.724905968 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:10:09.724927902 CEST	443	49712	117.252.68.211	192.168.2.5
Apr 28, 2021 17:10:12.772166967 CEST	49716	80	192.168.2.5	216.239.32.21
Apr 28, 2021 17:10:12.814766884 CEST	80	49716	216.239.32.21	192.168.2.5
Apr 28, 2021 17:10:12.814918041 CEST	49716	80	192.168.2.5	216.239.32.21
Apr 28, 2021 17:11:02.310023069 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:02.804231882 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:02.808007956 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:02.810683966 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:03.339526892 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:03.373402119 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:03.378614902 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:03.893985033 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:03.922416925 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:04.454848051 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:04.661617041 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:04.728499889 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:05.042570114 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:05.629462004 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:06.132323027 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:06.132350922 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:06.132450104 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:06.191734076 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:07.207998991 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:07.669682026 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:07.909128904 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:07.910717010 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:08.381062031 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:08.745474100 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:08.746862888 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:09.294528008 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:09.464015007 CEST	443	49717	117.252.68.211	192.168.2.5
Apr 28, 2021 17:11:09.525755882 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:09.585040092 CEST	49717	443	192.168.2.5	117.252.68.211
Apr 28, 2021 17:11:10.053153992 CEST	443	49717	117.252.68.211	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 17:07:48.160593033 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:48.200809956 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:48.209230900 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:48.254340887 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:48.445698023 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:48.494424105 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:50.216670036 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:50.268507004 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:52.913378000 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:52.962208986 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:54.210639954 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:54.291165113 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:56.088862896 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:56.149188995 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:57.780459881 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:57.834247112 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:58.748929024 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:58.800805092 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 28, 2021 17:07:59.553164005 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:07:59.604929924 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:01.695460081 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:01.744214058 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:03.339021921 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:03.400693893 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:08.655849934 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:08.704713106 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:09.613068104 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:09.671700001 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:11.723964930 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:11.777609110 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:16.887226105 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:16.935991049 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:27.508649111 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:27.568825006 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:36.145446062 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:36.205780983 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:43.770411968 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:43.833728075 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 28, 2021 17:08:58.928292036 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:08:58.978487968 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 28, 2021 17:09:03.217358112 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:09:03.311316013 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 17:09:03.324460983 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:09:03.384957075 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 28, 2021 17:11:03.327486038 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:11:03.386709929 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 28, 2021 17:11:04.729396105 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:11:04.789280891 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 28, 2021 17:11:09.466181040 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:11:09.524808884 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 28, 2021 17:11:09.526842117 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 28, 2021 17:11:09.583750010 CEST	53	58530	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 28, 2021 17:08:58.928292036 CEST	192.168.2.5	8.8.8.8	0x99eb	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
Apr 28, 2021 17:09:03.217358112 CEST	192.168.2.5	8.8.8.8	0x866b	Standard query (0)	3.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Apr 28, 2021 17:09:03.324460983 CEST	192.168.2.5	8.8.8.8	0xeeb	Standard query (0)	3.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Apr 28, 2021 17:11:04.729396105 CEST	192.168.2.5	8.8.8.8	0x1287	Standard query (0)	ident.me	A (IP address)	IN (0x0001)
Apr 28, 2021 17:11:09.466181040 CEST	192.168.2.5	8.8.8.8	0x49ca	Standard query (0)	3.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Apr 28, 2021 17:11:09.526842117 CEST	192.168.2.5	8.8.8.8	0x219a	Standard query (0)	3.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 28, 2021 17:08:58.978487968 CEST	8.8.8.8	192.168.2.5	0x99eb	No error (0)	ipinfo.io		216.239.32.21	A (IP address)	IN (0x0001)
Apr 28, 2021 17:08:58.978487968 CEST	8.8.8.8	192.168.2.5	0x99eb	No error (0)	ipinfo.io		216.239.38.21	A (IP address)	IN (0x0001)
Apr 28, 2021 17:08:58.978487968 CEST	8.8.8.8	192.168.2.5	0x99eb	No error (0)	ipinfo.io		216.239.36.21	A (IP address)	IN (0x0001)
Apr 28, 2021 17:08:58.978487968 CEST	8.8.8.8	192.168.2.5	0x99eb	No error (0)	ipinfo.io		216.239.34.21	A (IP address)	IN (0x0001)
Apr 28, 2021 17:09:03.311316013 CEST	8.8.8.8	192.168.2.5	0x866b	Name error (3)	3.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Apr 28, 2021 17:09:03.384957075 CEST	8.8.8.8	192.168.2.5	0xeeb	No error (0)	3.52.17.84.cbl.abuseat.org		127.0.0.2	A (IP address)	IN (0x0001)
Apr 28, 2021 17:11:04.789280891 CEST	8.8.8.8	192.168.2.5	0x1287	No error (0)	ident.me		176.58.123.25	A (IP address)	IN (0x0001)
Apr 28, 2021 17:11:09.524808884 CEST	8.8.8.8	192.168.2.5	0x49ca	Name error (3)	3.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Apr 28, 2021 17:11:09.583750010 CEST	8.8.8.8	192.168.2.5	0x219a	No error (0)	3.52.17.84.cbl.abuseat.org		127.0.0.2	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

ipinfo.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49716	216.239.32.21	80	C:\Windows\System32\wermgr.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 17:08:59.043179989 CEST	679	OUT	GET /ip HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.74.0 Host: ipinfo.io
Apr 28, 2021 17:08:59.200871944 CEST	679	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 15:08:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 10 Access-Control-Allow-Origin: * Via: 1.1 google Data Raw: 38 34 2e 31 37 2e 35 32 2e 33 Data Ascii: 84.17.52.3

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 28, 2021 17:08:23.753757000 CEST	117.252.68.211	443	192.168.2.5	49712	O=Internet Widgits Pty Ltd, ST=Some-State, C=AU	O=Internet Widgits Pty Ltd, ST=Some-State, C=AU	Mon Apr 19 22:44:16 CEST 2021	Tue Apr 19 22:44:16 CEST 2022	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0	8916410db85077a5460817142dcbc8de
Apr 28, 2021 17:11:03.373402119 CEST	117.252.68.211	443	192.168.2.5	49717	O=Internet Widgits Pty Ltd, ST=Some-State, C=AU	O=Internet Widgits Pty Ltd, ST=Some-State, C=AU	Mon Apr 19 22:44:16 CEST 2021	Tue Apr 19 22:44:16 CEST 2022	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0	8916410db85077a5460817142dcbc8de

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 2272 Parent PID: 5740

General

Start time:	17:07:55
Start date:	28/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll'
Imagebase:	0xb20000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4940 Parent PID: 2272

General

Start time:	17:07:55
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4012 Parent PID: 2272

General

Start time:	17:07:55
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll,StartW
Imagebase:	0xd30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000002.316290050.0000000000C50000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000002.301654688.0000000000BB0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000002.342880872.00000000047F0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1068 Parent PID: 4940

General

Start time:	17:07:55
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',#1
Imagebase:	0xd30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000005.00000002.368401033.0000000004B00000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000005.00000002.345834553.00000000032B0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: wermgr.exe PID: 6164 Parent PID: 4012

General

Start time:	17:07:57
Start date:	28/04/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0x7ff662b40000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wermgr.exe PID: 6176 Parent PID: 1068

General

Start time:	17:07:57
Start date:	28/04/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0x7ff662b40000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6320 Parent PID: 4012

General

Start time:	17:07:59
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 704
Imagebase:	0x1030000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6328 Parent PID: 2272

General

Start time:	17:07:59
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll',StartW
Imagebase:	0xd30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 0000000C.00000002.358957054.0000000004FA0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 0000000C.00000002.330027529.0000000003410000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 0000000C.00000002.330091629.00000000034B0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6336 Parent PID: 1068

General

Start time:	17:07:59
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 712
Imagebase:	0x1030000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wermgr.exe PID: 6380 Parent PID: 6328

General

Start time:	17:08:00
Start date:	28/04/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0x7ff662b40000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6480 Parent PID: 6328

General

Start time:	17:08:02
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 712
Imagebase:	0x1030000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 4012 Parent PID: 2272 rundll32.exeCOMMON

Executed Functions

Function 6DD3C19C, Relevance: 1547.0, APIs: 1, Strings: 1017, Instructions: 20001memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00003000,00000004), ref: 6DD4C2AA
VirtualAlloc.KERNELBASE(00000000,00003000,00000004), ref: 6DD64207

Strings

dAk, xrefs: 6DD668EB
o]_@, xrefs: 6DD685F3
UUUU, xrefs: 6DD4CEDA
3333, xrefs: 6DD4F4F2
dAk, xrefs: 6DD531D3
UUUU, xrefs: 6DD5CEAF
o]_@, xrefs: 6DD50804
UUUU, xrefs: 6DD47BC1
dAk, xrefs: 6DD4F2E8
dAk, xrefs: 6DD520E1
3333, xrefs: 6DD505FC
o]_@, xrefs: 6DD61807
dAk, xrefs: 6DD436FB
UUUU, xrefs: 6DD484F2
o]_@, xrefs: 6DD40B0D
UUUU, xrefs: 6DD4128C
dAk, xrefs: 6DD55CAB
dAk, xrefs: 6DD497CA
o]_@, xrefs: 6DD631F8
3333, xrefs: 6DD48D51
3333, xrefs: 6DD66AF5
2333, xrefs: 6DD44002
3333, xrefs: 6DD3DA15
UUUU, xrefs: 6DD42429
UUUU, xrefs: 6DD403C4
dAk, xrefs: 6DD507D5
UUUU, xrefs: 6DD5F0DF
UUUU, xrefs: 6DD42CF6
2333, xrefs: 6DD58394
UUUU, xrefs: 6DD5DFEB
UUUU, xrefs: 6DD513D9
UUUU, xrefs: 6DD5C5E6
o]_@, xrefs: 6DD58377
UUUU, xrefs: 6DD5FBD7
UUUU, xrefs: 6DD3FAD9
dAk, xrefs: 6DD642A0
o]_@, xrefs: 6DD3DAAA
o]_@, xrefs: 6DD67A0B
dAk, xrefs: 6DD4A8ED
UUUU, xrefs: 6DD615D2
3333, xrefs: 6DD53076
L2L, xrefs: 6DD630FC
dAk, xrefs: 6DD542C6
dAk, xrefs: 6DD4E5A0
UUUU, xrefs: 6DD50E7F
o]_@, xrefs: 6DD42657
UUUU, xrefs: 6DD4D206
UUUU, xrefs: 6DD5411B
dAk, xrefs: 6DD43AC7
dAk, xrefs: 6DD4CB75
UUUU, xrefs: 6DD67B90
2333, xrefs: 6DD4FBFC
3333, xrefs: 6DD4DACE
2333, xrefs: 6DD5A588
UUUU, xrefs: 6DD6049B
UUUU, xrefs: 6DD52FE0
UUUU, xrefs: 6DD4AF15
o]_@, xrefs: 6DD69381
o]_@, xrefs: 6DD42F27
3333, xrefs: 6DD4B8A8
UUUU, xrefs: 6DD6016C
o]_@, xrefs: 6DD4AE09
3333, xrefs: 6DD41675
o]_@, xrefs: 6DD48FC7
dAk, xrefs: 6DD60657
3333, xrefs: 6DD5D20C
dAk, xrefs: 6DD628EE
3333, xrefs: 6DD4A762
o]_@, xrefs: 6DD671DA
3333, xrefs: 6DD4FDDC
dAk, xrefs: 6DD6428A
dAk, xrefs: 6DD59C39
dAk, xrefs: 6DD5FDEE
o]_@, xrefs: 6DD586D2
dAk, xrefs: 6DD5A003
3333, xrefs: 6DD69584
UUUU, xrefs: 6DD4FCEC
dAk, xrefs: 6DD56511
3333, xrefs: 6DD5AFEF
o]_@, xrefs: 6DD3F9CC
o]_@, xrefs: 6DD402C1
o]_@, xrefs: 6DD51592
o]_@, xrefs: 6DD5652A
o]_@, xrefs: 6DD5F295
UUUU, xrefs: 6DD4302E
dAk, xrefs: 6DD4D3C1
3333, xrefs: 6DD58DA5
2333, xrefs: 6DD425FC
dAk, xrefs: 6DD63A32
dAk, xrefs: 6DD5FA67
2333, xrefs: 6DD4AE26
UUUU, xrefs: 6DD6839E
dAk, xrefs: 6DD58F1F
o]_@, xrefs: 6DD56A29
UUUU, xrefs: 6DD3E15A
UUUU, xrefs: 6DD4009B
UUUU, xrefs: 6DD67858
o]_@, xrefs: 6DD41DD1
3333, xrefs: 6DD61653
3333, xrefs: 6DD49670
2333, xrefs: 6DD450FA
dAk, xrefs: 6DD53A59
3333, xrefs: 6DD66332
UUUU, xrefs: 6DD47C30
3333, xrefs: 6DD3C9A7
o]_@, xrefs: 6DD4E232
dAk, xrefs: 6DD53688
o]_@, xrefs: 6DD59D15
UUUU, xrefs: 6DD4D194
UUUU, xrefs: 6DD4E33C
o]_@, xrefs: 6DD61D7F
o]_@, xrefs: 6DD5943A
dAk, xrefs: 6DD507EB
UUUU, xrefs: 6DD5B79D
dAk, xrefs: 6DD42E4B
UUUU, xrefs: 6DD415BB
o]_@, xrefs: 6DD3D274
UUUU, xrefs: 6DD63572
o]_@, xrefs: 6DD448E2
UUUU, xrefs: 6DD65A0C
o]_@, xrefs: 6DD61453
o]_@, xrefs: 6DD420B2
UUUU, xrefs: 6DD648C5
UUUU, xrefs: 6DD4A405
dAk, xrefs: 6DD63A48
UUUU, xrefs: 6DD3D650
o]_@, xrefs: 6DD4C8DF
o]_@, xrefs: 6DD650DA
2333, xrefs: 6DD4145E
dAk, xrefs: 6DD47554
dAk, xrefs: 6DD5B9B9
o]_@, xrefs: 6DD559FD
o]_@, xrefs: 6DD469E5
UUUU, xrefs: 6DD451EA
dAk, xrefs: 6DD45C68
2333, xrefs: 6DD4A5DA
UUUU, xrefs: 6DD3D0EC
UUUU, xrefs: 6DD3C923
2333, xrefs: 6DD68B49
o]_@, xrefs: 6DD44BB0
UUUU, xrefs: 6DD5B4DA
dAk, xrefs: 6DD64757
UUUU, xrefs: 6DD440F8
o]_@, xrefs: 6DD48C20
o]_@, xrefs: 6DD425DF
o]_@, xrefs: 6DD4C025
3333, xrefs: 6DD4634E
o]_@, xrefs: 6DD51E40
o]_@, xrefs: 6DD66CAD
3333, xrefs: 6DD40CB9
UUUU, xrefs: 6DD557D2
2333, xrefs: 6DD461BF
UUUU, xrefs: 6DD573F7
o]_@, xrefs: 6DD486AB
3333, xrefs: 6DD53895
UUUU, xrefs: 6DD4C97A
dAk, xrefs: 6DD4613E
dAk, xrefs: 6DD4C349
3333, xrefs: 6DD51FE7
dAk, xrefs: 6DD53A38
UUUU, xrefs: 6DD5D1DE
o]_@, xrefs: 6DD54017
3333, xrefs: 6DD56C5C
o]_@, xrefs: 6DD531EC
3333, xrefs: 6DD55B88
UUUU, xrefs: 6DD3EF06
dAk, xrefs: 6DD4DD1A
dAk, xrefs: 6DD586B9
2333, xrefs: 6DD559A2
o]_@, xrefs: 6DD4953C
3333, xrefs: 6DD4E3DC
UUUU, xrefs: 6DD44F27
dAk, xrefs: 6DD65BF7
2333, xrefs: 6DD48390
o]_@, xrefs: 6DD3E2E2
o]_@, xrefs: 6DD4DD33
o]_@, xrefs: 6DD46A5D
UUUU, xrefs: 6DD527C3
2333, xrefs: 6DD49D30
3333, xrefs: 6DD43909
dAk, xrefs: 6DD4F67D
UUUU, xrefs: 6DD55B07
UUUU, xrefs: 6DD47078
o]_@, xrefs: 6DD4C362
UUUU, xrefs: 6DD5A3B2
dAk, xrefs: 6DD5869F
3333, xrefs: 6DD41F5F
UUUU, xrefs: 6DD48D23
dAk, xrefs: 6DD48F95
3333, xrefs: 6DD595E1
3333, xrefs: 6DD4418E
o]_@, xrefs: 6DD5FE1D
dAk, xrefs: 6DD62DD3
UUUU, xrefs: 6DD40355
o]_@, xrefs: 6DD5C812
2333, xrefs: 6DD5D8D5
o]_@, xrefs: 6DD3E8F5
UUUU, xrefs: 6DD551E8
UUUU, xrefs: 6DD68CA8
UUUU, xrefs: 6DD473A7
o]_@, xrefs: 6DD4F3C4
dAk, xrefs: 6DD617D8
o]_@, xrefs: 6DD450DD
UUUU, xrefs: 6DD66AC7
o]_@, xrefs: 6DD67503
3333, xrefs: 6DD5B836
3333, xrefs: 6DD3D182
dAk, xrefs: 6DD58B9E
o]_@, xrefs: 6DD4D100
UUUU, xrefs: 6DD64605
o]_@, xrefs: 6DD464E5
o]_@, xrefs: 6DD60BB7
3333, xrefs: 6DD61F26
o]_@, xrefs: 6DD5ADEF
o]_@, xrefs: 6DD4433A
o]_@, xrefs: 6DD5B163
o]_@, xrefs: 6DD3D887
3333, xrefs: 6DD5B890
3333, xrefs: 6DD58DFF
2333, xrefs: 6DD6033A
dAk, xrefs: 6DD3F8F0
3333, xrefs: 6DD5F43B
dAk, xrefs: 6DD60671
UUUU, xrefs: 6DD4B7B5
3333, xrefs: 6DD4CA10
3333, xrefs: 6DD673DA
dAk, xrefs: 6DD3F05F
dAk, xrefs: 6DD55006
o]_@, xrefs: 6DD57B75
o]_@, xrefs: 6DD62599
UUUU, xrefs: 6DD4095F
3333, xrefs: 6DD65205
3333, xrefs: 6DD5EC22
3333, xrefs: 6DD638CE
o]_@, xrefs: 6DD3E877
3333, xrefs: 6DD47448
UUUU, xrefs: 6DD449E9
3333, xrefs: 6DD5A76B
2333, xrefs: 6DD3D826
dAk, xrefs: 6DD5CB47
dAk, xrefs: 6DD5CB31
dAk, xrefs: 6DD4830F
UUUU, xrefs: 6DD59AEC
o]_@, xrefs: 6DD6618B
dAk, xrefs: 6DD5F231
o]_@, xrefs: 6DD461A2
dAk, xrefs: 6DD3DB13
UUUU, xrefs: 6DD626A5
UUUU, xrefs: 6DD4EC31
dAk, xrefs: 6DD5A507
o]_@, xrefs: 6DD42EAF
3333, xrefs: 6DD46B8E
UUUU, xrefs: 6DD5248E
o]_@, xrefs: 6DD5B9D2
UUUU, xrefs: 6DD4AF84
3333, xrefs: 6DD54A3E
dAk, xrefs: 6DD4294C
UUUU, xrefs: 6DD570C5
dAk, xrefs: 6DD41838
o]_@, xrefs: 6DD4B720
dAk, xrefs: 6DD56D4A
dAk, xrefs: 6DD4B644
3333, xrefs: 6DD57CFD
3333, xrefs: 6DD49F3F
UUUU, xrefs: 6DD5AF6E
dAk, xrefs: 6DD44B7D
dAk, xrefs: 6DD5E4BE
o]_@, xrefs: 6DD3CA3C
UUUU, xrefs: 6DD4AC55
UUUU, xrefs: 6DD57C0A
o]_@, xrefs: 6DD4FBDF
UUUU, xrefs: 6DD6406A
3333, xrefs: 6DD5E341
UUUU, xrefs: 6DD61E85
2333, xrefs: 6DD47AD1
o]_@, xrefs: 6DD3F0C3
UUUU, xrefs: 6DD62FB3
dAk, xrefs: 6DD6931D
o]_@, xrefs: 6DD4BAA2
o]_@, xrefs: 6DD65062
o]_@, xrefs: 6DD4F34C
o]_@, xrefs: 6DD4FC57
o]_@, xrefs: 6DD4325D
3333, xrefs: 6DD6952A
dAk, xrefs: 6DD5FE04
UUUU, xrefs: 6DD45FEC
UUUU, xrefs: 6DD4A6C5
dAk, xrefs: 6DD46981
2333, xrefs: 6DD4377E
dAk, xrefs: 6DD67D2E
UUUU, xrefs: 6DD502A6
UUUU, xrefs: 6DD44167
dAk, xrefs: 6DD59787
2333, xrefs: 6DD48BC5
dAk, xrefs: 6DD51049
o]_@, xrefs: 6DD572F1
o]_@, xrefs: 6DD62907
o]_@, xrefs: 6DD4FF66
o]_@, xrefs: 6DD542E2
3333, xrefs: 6DD57CA3
dAk, xrefs: 6DD56169
dAk, xrefs: 6DD631C5
o]_@, xrefs: 6DD5D060
dAk, xrefs: 6DD49463
dAk, xrefs: 6DD405FA
UUUU, xrefs: 6DD41E6C
dAk, xrefs: 6DD54783
UUUU, xrefs: 6DD623E8
dAk, xrefs: 6DD531BD
dAk, xrefs: 6DD4756E
2333, xrefs: 6DD6507F
UUUU, xrefs: 6DD5B80F
3333, xrefs: 6DD5EB96
dAk, xrefs: 6DD660AF
UUUU, xrefs: 6DD67359
dAk, xrefs: 6DD5A88F
dAk, xrefs: 6DD44307
UUUU, xrefs: 6DD49E94
dAk, xrefs: 6DD68E47
o]_@, xrefs: 6DD59C9D
o]_@, xrefs: 6DD536EC
o]_@, xrefs: 6DD68BA4
2333, xrefs: 6DD3C7B5
dAk, xrefs: 6DD5C27E
dAk, xrefs: 6DD57E4B
o]_@, xrefs: 6DD5CB60
o]_@, xrefs: 6DD5B708
dAk, xrefs: 6DD60F0A
3333, xrefs: 6DD4AFB2
UUUU, xrefs: 6DD58D7E
o]_@, xrefs: 6DD4A5BB
UUUU, xrefs: 6DD481BA
3333, xrefs: 6DD506A0
2333, xrefs: 6DD59CBA
3333, xrefs: 6DD3FB00
dAk, xrefs: 6DD4B15F
2333, xrefs: 6DD55087
3333, xrefs: 6DD55289
o]_@, xrefs: 6DD57E7A
UUUU, xrefs: 6DD41BA6
dAk, xrefs: 6DD47A53
UUUU, xrefs: 6DD46327
3333, xrefs: 6DD4C1B0
o]_@, xrefs: 6DD4CB8E
UUUU, xrefs: 6DD438DB
UUUU, xrefs: 6DD5353B
o]_@, xrefs: 6DD4C867
o]_@, xrefs: 6DD47229
o]_@, xrefs: 6DD61D07
dAk, xrefs: 6DD64B19
dAk, xrefs: 6DD55924
dAk, xrefs: 6DD4EDE9
dAk, xrefs: 6DD62538
dAk, xrefs: 6DD43AB1
UUUU, xrefs: 6DD5C918
3333, xrefs: 6DD5C946
2333, xrefs: 6DD50D25
o]_@, xrefs: 6DD4A906
dAk, xrefs: 6DD44B97
dAk, xrefs: 6DD49CAF
3333, xrefs: 6DD6525F
o]_@, xrefs: 6DD3C798
o]_@, xrefs: 6DD561CA
2333, xrefs: 6DD63F7B
2333, xrefs: 6DD61470
o]_@, xrefs: 6DD4B6A8
dAk, xrefs: 6DD64AF8
3333, xrefs: 6DD627B8
dAk, xrefs: 6DD685C4
3333, xrefs: 6DD3E1F0
UUUU, xrefs: 6DD59DA9
2333, xrefs: 6DD63745
o]_@, xrefs: 6DD52644
o]_@, xrefs: 6DD642B9
dAk, xrefs: 6DD5B62F
2333, xrefs: 6DD5BEF6
UUUU, xrefs: 6DD5170E
o]_@, xrefs: 6DD40F3D
3333, xrefs: 6DD64965
o]_@, xrefs: 6DD5DC71
o]_@, xrefs: 6DD51DC8
L2L, xrefs: 6DD4FE77
o]_@, xrefs: 6DD53764
3333, xrefs: 6DD5C081
dAk, xrefs: 6DD5CFFC
UUUU, xrefs: 6DD462B5
UUUU, xrefs: 6DD3F792
o]_@, xrefs: 6DD5C79C
dAk, xrefs: 6DD56D60
dAk, xrefs: 6DD44806
dAk, xrefs: 6DD4C806
dAk, xrefs: 6DD4CB5F
dAk, xrefs: 6DD43244
o]_@, xrefs: 6DD437D5
2333, xrefs: 6DD57296
UUUU, xrefs: 6DD68C39
dAk, xrefs: 6DD42966
dAk, xrefs: 6DD65365
dAk, xrefs: 6DD401E8
2333, xrefs: 6DD3E894
dAk, xrefs: 6DD3FD20
dAk, xrefs: 6DD60EE9
o]_@, xrefs: 6DD67D61
3333, xrefs: 6DD51735
UUUU, xrefs: 6DD44977
2333, xrefs: 6DD53709
UUUU, xrefs: 6DD581C6
UUUU, xrefs: 6DD63835
o]_@, xrefs: 6DD58BFF
UUUU, xrefs: 6DD4E07F
2333, xrefs: 6DD67A28
3333, xrefs: 6DD40465
3333, xrefs: 6DD48573
UUUU, xrefs: 6DD4BDF7
o]_@, xrefs: 6DD5A8C2
2333, xrefs: 6DD40B2A
o]_@, xrefs: 6DD583EF
3333, xrefs: 6DD5D27F
UUUU, xrefs: 6DD59284
3333, xrefs: 6DD57425
UUUU, xrefs: 6DD5FC49
o]_@, xrefs: 6DD64831
dAk, xrefs: 6DD57215
UUUU, xrefs: 6DD3DE8B
o]_@, xrefs: 6DD56D79
dAk, xrefs: 6DD4D027
dAk, xrefs: 6DD5B14A
3333, xrefs: 6DD530D0
dAk, xrefs: 6DD5102F
UUUU, xrefs: 6DD53DE9
o]_@, xrefs: 6DD5160A
o]_@, xrefs: 6DD58F38
dAk, xrefs: 6DD575A0
o]_@, xrefs: 6DD5F30D
dAk, xrefs: 6DD405E4
o]_@, xrefs: 6DD494C4
o]_@, xrefs: 6DD47587
UUUU, xrefs: 6DD4E3AE
UUUU, xrefs: 6DD64EAC
dAk, xrefs: 6DD62080
dAk, xrefs: 6DD3D7A8
UUUU, xrefs: 6DD66291
3333, xrefs: 6DD6410A
UUUU, xrefs: 6DD4C6B4
o]_@, xrefs: 6DD60C2F
UUUU, xrefs: 6DD4DA38
dAk, xrefs: 6DD48FAB
dAk, xrefs: 6DD57A9C
UUUU, xrefs: 6DD45AD3
o]_@, xrefs: 6DD62E37
dAk, xrefs: 6DD50CA2
o]_@, xrefs: 6DD47E40
UUUU, xrefs: 6DD56876
dAk, xrefs: 6DD5C268
3333, xrefs: 6DD49EC2
o]_@, xrefs: 6DD52114
dAk, xrefs: 6DD5ED35
2333, xrefs: 6DD4EAD0
dAk, xrefs: 6DD3D2D8
dAk, xrefs: 6DD3C734
2333, xrefs: 6DD66130
dAk, xrefs: 6DD67179
3333, xrefs: 6DD5FCEA
3333, xrefs: 6DD4DB28
dAk, xrefs: 6DD569C8
3333, xrefs: 6DD5A711
UUUU, xrefs: 6DD537F8
3333, xrefs: 6DD5419C
o]_@, xrefs: 6DD58C77
dAk, xrefs: 6DD5AD8B
o]_@, xrefs: 6DD63FD6
o]_@, xrefs: 6DD4F6AC
3333, xrefs: 6DD68D29
2333, xrefs: 6DD4BFC7
3333, xrefs: 6DD4B025
UUUU, xrefs: 6DD49642
o]_@, xrefs: 6DD550E2
o]_@, xrefs: 6DD4143F
dAk, xrefs: 6DD4EE03
2333, xrefs: 6DD59459
dAk, xrefs: 6DD66C94
3333, xrefs: 6DD65AC6
dAk, xrefs: 6DD52E72
o]_@, xrefs: 6DD43AE0
2333, xrefs: 6DD52661
o]_@, xrefs: 6DD459CF
3333, xrefs: 6DD57498
3333, xrefs: 6DD61EB3
dAk, xrefs: 6DD4A08A
UUUU, xrefs: 6DD6621F
o]_@, xrefs: 6DD49D13
dAk, xrefs: 6DD5ED4F
UUUU, xrefs: 6DD4C9E9
UUUU, xrefs: 6DD43E32
3333, xrefs: 6DD47C57
3333, xrefs: 6DD46C01
3333, xrefs: 6DD68437
2333, xrefs: 6DD3F0E0
dAk, xrefs: 6DD3EB91
UUUU, xrefs: 6DD5DA2E
dAk, xrefs: 6DD3C233
3333, xrefs: 6DD4FD82
UUUU, xrefs: 6DD3C5DF
UUUU, xrefs: 6DD446B1
dAk, xrefs: 6DD458F3
o]_@, xrefs: 6DD4D3FB
o]_@, xrefs: 6DD5E9EF
UUUU, xrefs: 6DD49E22
3333, xrefs: 6DD4D2A7
UUUU, xrefs: 6DD40C8B
o]_@, xrefs: 6DD50D7C
UUUU, xrefs: 6DD4F4CB
UUUU, xrefs: 6DD64937
UUUU, xrefs: 6DD3D922
3333, xrefs: 6DD63928
2333, xrefs: 6DD561E7
dAk, xrefs: 6DD631DF
o]_@, xrefs: 6DD693F9
3333, xrefs: 6DD48519
dAk, xrefs: 6DD5B9A3
UUUU, xrefs: 6DD58483
o]_@, xrefs: 6DD52F4B
UUUU, xrefs: 6DD4FD5B
dAk, xrefs: 6DD464B6
3333, xrefs: 6DD54987
o]_@, xrefs: 6DD62611
2333, xrefs: 6DD3CFF0
o]_@, xrefs: 6DD5EA65
dAk, xrefs: 6DD66423
o]_@, xrefs: 6DD65909
dAk, xrefs: 6DD413DE
UUUU, xrefs: 6DD5BD21
UUUU, xrefs: 6DD66A58
UUUU, xrefs: 6DD46834
3333, xrefs: 6DD4ECD2
o]_@, xrefs: 6DD45957
o]_@, xrefs: 6DD4AE81
2333, xrefs: 6DD5047C
`m, xrefs: 6DD4DC1D
UUUU, xrefs: 6DD595B3
o]_@, xrefs: 6DD669C4
UUUU, xrefs: 6DD5D9BF
o]_@, xrefs: 6DD3F3DB
3333, xrefs: 6DD40D2C
dAk, xrefs: 6DD52990
o]_@, xrefs: 6DD4D088
UUUU, xrefs: 6DD61560
o]_@, xrefs: 6DD5BF4D
o]_@, xrefs: 6DD57AFD
UUUU, xrefs: 6DD4B4EF
UUUU, xrefs: 6DD49313
dAk, xrefs: 6DD68AC8
dAk, xrefs: 6DD4C333
dAk, xrefs: 6DD5D38A
3333, xrefs: 6DD615F9
o]_@, xrefs: 6DD68E76
dAk, xrefs: 6DD4F693
o]_@, xrefs: 6DD4A631
o]_@, xrefs: 6DD6068A
2333, xrefs: 6DD515AF
3333, xrefs: 6DD45283
UUUU, xrefs: 6DD65F5F
o]_@, xrefs: 6DD6694C
2333, xrefs: 6DD494E1
dAk, xrefs: 6DD4B145
o]_@, xrefs: 6DD5D3BC
dAk, xrefs: 6DD3DFE0
o]_@, xrefs: 6DD5D930
dAk, xrefs: 6DD3E349
2333, xrefs: 6DD42ECC
dAk, xrefs: 6DD4A8D7
o]_@, xrefs: 6DD45424
3333, xrefs: 6DD3F2E8
o]_@, xrefs: 6DD48373
2333, xrefs: 6DD54801
UUUU, xrefs: 6DD60D36
2333, xrefs: 6DD5FAE8
2333, xrefs: 6DD6939E
dAk, xrefs: 6DD48B44
3333, xrefs: 6DD4B84E
o]_@, xrefs: 6DD5ED68
UUUU, xrefs: 6DD3E6BE
o]_@, xrefs: 6DD52ED3
dAk, xrefs: 6DD47E06
3333, xrefs: 6DD50F39
UUUU, xrefs: 6DD5AC39
UUUU, xrefs: 6DD4EBBF
dAk, xrefs: 6DD68230
UUUU, xrefs: 6DD42FBC
UUUU, xrefs: 6DD3CE1A
UUUU, xrefs: 6DD63DAD
dAk, xrefs: 6DD52976
dAk, xrefs: 6DD575BA
UUUU, xrefs: 6DD57C7C
dAk, xrefs: 6DD4BF49
3333, xrefs: 6DD66B68
dAk, xrefs: 6DD4E58A
dAk, xrefs: 6DD4540B
o]_@, xrefs: 6DD48BA8
o]_@, xrefs: 6DD4EB2B
dAk, xrefs: 6DD503FB
dAk, xrefs: 6DD43F84
dAk, xrefs: 6DD46CFD
2333, xrefs: 6DD4F369
UUUU, xrefs: 6DD56019
dAk, xrefs: 6DD4E1CE
2333, xrefs: 6DD61D24
dAk, xrefs: 6DD520FB
3333, xrefs: 6DD6053C
o]_@, xrefs: 6DD55985
dAk, xrefs: 6DD55422
o]_@, xrefs: 6DD4B178
dAk, xrefs: 6DD453F1
UUUU, xrefs: 6DD54EB9
o]_@, xrefs: 6DD4D9A3
UUUU, xrefs: 6DD60429
o]_@, xrefs: 6DD4E2A8
dAk, xrefs: 6DD5B130
dAk, xrefs: 6DD464CC
dAk, xrefs: 6DD4507C
UUUU, xrefs: 6DD4C0C0
o]_@, xrefs: 6DD5BED7
o]_@, xrefs: 6DD5045F
dAk, xrefs: 6DD5DC58
dAk, xrefs: 6DD3CAA5
3333, xrefs: 6DD67C11
o]_@, xrefs: 6DD60395
UUUU, xrefs: 6DD40C19
3333, xrefs: 6DD60D5D
2333, xrefs: 6DD3E05E
dAk, xrefs: 6DD5A019
3333, xrefs: 6DD463A8
o]_@, xrefs: 6DD594B0
3333, xrefs: 6DD68CCF
o]_@, xrefs: 6DD526BC
UUUU, xrefs: 6DD640DC
UUUU, xrefs: 6DD43869
UUUU, xrefs: 6DD562D9
3333, xrefs: 6DD41F05
dAk, xrefs: 6DD617EE
o]_@, xrefs: 6DD5485F
3333, xrefs: 6DD5C10D
UUUU, xrefs: 6DD3D991
2333, xrefs: 6DD51DE5
o]_@, xrefs: 6DD4375F
UUUU, xrefs: 6DD4FA29
3333, xrefs: 6DD4F54C
3333, xrefs: 6DD496E3
2333, xrefs: 6DD5AE0C
2333, xrefs: 6DD57B1A
UUUU, xrefs: 6DD5F414
UUUU, xrefs: 6DD68973
dAk, xrefs: 6DD564FB
dAk, xrefs: 6DD4FF4D
o]_@, xrefs: 6DD47B2C
2333, xrefs: 6DD3F96E
dAk, xrefs: 6DD48692
UUUU, xrefs: 6DD47335
dAk, xrefs: 6DD4BA89
UUUU, xrefs: 6DD5EAF9
dAk, xrefs: 6DD5BE73
o]_@, xrefs: 6DD575D3
o]_@, xrefs: 6DD3F951
3333, xrefs: 6DD59E46
o]_@, xrefs: 6DD3D809
o]_@, xrefs: 6DD4621A
o]_@, xrefs: 6DD518C5
UUUU, xrefs: 6DD47901
o]_@, xrefs: 6DD5A5E3
o]_@, xrefs: 6DD55CC7
dAk, xrefs: 6DD58313
2333, xrefs: 6DD58C1C
o]_@, xrefs: 6DD68309
dAk, xrefs: 6DD45C7E
UUUU, xrefs: 6DD67027
2333, xrefs: 6DD682AE
dAk, xrefs: 6DD4ADA5
UUUU, xrefs: 6DD540AC
o]_@, xrefs: 6DD57279
UUUU, xrefs: 6DD5D6FC
UUUU, xrefs: 6DD61B53
o]_@, xrefs: 6DD45155
o]_@, xrefs: 6DD483EB
UUUU, xrefs: 6DD5D16C
UUUU, xrefs: 6DD51ED4
UUUU, xrefs: 6DD41549
UUUU, xrefs: 6DD59E18
3333, xrefs: 6DD5966D
3333, xrefs: 6DD4CA6A
2333, xrefs: 6DD46A02
3333, xrefs: 6DD55216
o]_@, xrefs: 6DD4405D
3333, xrefs: 6DD55B2E
3333, xrefs: 6DD662BF
o]_@, xrefs: 6DD3E041
UUUU, xrefs: 6DD4C12F
3333, xrefs: 6DD473D5
o]_@, xrefs: 6DD41D59
o]_@, xrefs: 6DD4D92B
UUUU, xrefs: 6DD48CB4
dAk, xrefs: 6DD41822
3333, xrefs: 6DD42785
dAk, xrefs: 6DD53F3E
3333, xrefs: 6DD67BB7
UUUU, xrefs: 6DD62717
UUUU, xrefs: 6DD3D15B
UUUU, xrefs: 6DD505D5
UUUU, xrefs: 6DD69494
3333, xrefs: 6DD65A3A
dAk, xrefs: 6DD59771
3333, xrefs: 6DD51F74
UUUU, xrefs: 6DD3F244
3333, xrefs: 6DD50EAD
dAk, xrefs: 6DD628D4
dAk, xrefs: 6DD4867C
3333, xrefs: 6DD62745
o]_@, xrefs: 6DD4A0B9
dAk, xrefs: 6DD3F3EE
UUUU, xrefs: 6DD57385
o]_@, xrefs: 6DD5E19E
o]_@, xrefs: 6DD5C297
o]_@, xrefs: 6DD65893
UUUU, xrefs: 6DD4275E
UUUU, xrefs: 6DD651DE
UUUU, xrefs: 6DD3E9FF
2333, xrefs: 6DD45974
3333, xrefs: 6DD430AF
3333, xrefs: 6DD48DC4
3333, xrefs: 6DD4C156
2333, xrefs: 6DD4D0A5
dAk, xrefs: 6DD542B0
o]_@, xrefs: 6DD63A61
o]_@, xrefs: 6DD68B2C
o]_@, xrefs: 6DD5D0D8
3333, xrefs: 6DD5FC77
UUUU, xrefs: 6DD69503
dAk, xrefs: 6DD4257E
3333, xrefs: 6DD60DB7
dAk, xrefs: 6DD57E61
o]_@, xrefs: 6DD5E216
2333, xrefs: 6DD41D76
UUUU, xrefs: 6DD672E7
UUUU, xrefs: 6DD5AEFC
3333, xrefs: 6DD43055
UUUU, xrefs: 6DD45A64
UUUU, xrefs: 6DD56B33
UUUU, xrefs: 6DD53867
2333, xrefs: 6DD5F2B2
dAk, xrefs: 6DD41CF8
dAk, xrefs: 6DD518AC
o]_@, xrefs: 6DD5B690
o]_@, xrefs: 6DD53A72
3333, xrefs: 6DD4D234
2333, xrefs: 6DD66969
3333, xrefs: 6DD3C94A
UUUU, xrefs: 6DD60A04
UUUU, xrefs: 6DD426EC
dAk, xrefs: 6DD525E0
o]_@, xrefs: 6DD68291
UUUU, xrefs: 6DD656E0
3333, xrefs: 6DD5C9D2
o]_@, xrefs: 6DD63F5E
o]_@, xrefs: 6DD4BFAA
UUUU, xrefs: 6DD691CB
UUUU, xrefs: 6DD584F5
UUUU, xrefs: 6DD3E990
o]_@, xrefs: 6DD67252
3333, xrefs: 6DD4EC5F
UUUU, xrefs: 6DD489F7
o]_@, xrefs: 6DD5506A
o]_@, xrefs: 6DD56A9F
o]_@, xrefs: 6DD4E5B9
3333, xrefs: 6DD403F2
UUUU, xrefs: 6DD55A95
o]_@, xrefs: 6DD3E0BF
3333, xrefs: 6DD452DD
o]_@, xrefs: 6DD50D06
dAk, xrefs: 6DD68E5D
3333, xrefs: 6DD5F495
UUUU, xrefs: 6DD5EB68
3333, xrefs: 6DD59EB9
2333, xrefs: 6DD44887
3333, xrefs: 6DD441E8
3333, xrefs: 6DD3E24D
2333, xrefs: 6DD53FBC
UUUU, xrefs: 6DD58A49
3333, xrefs: 6DD68491
o]_@, xrefs: 6DD55458
o]_@, xrefs: 6DD414B5
dAk, xrefs: 6DD40F0B
dAk, xrefs: 6DD5F5B2
3333, xrefs: 6DD3FB5D
UUUU, xrefs: 6DD50E10
UUUU, xrefs: 6DD638A7
dAk, xrefs: 6DD636C4
dAk, xrefs: 6DD5C738
dAk, xrefs: 6DD4207F
dAk, xrefs: 6DD63EFD
UUUU, xrefs: 6DD4DAA7
UUUU, xrefs: 6DD4E905
UUUU, xrefs: 6DD5E31A
o]_@, xrefs: 6DD4EE1C
3333, xrefs: 6DD44A10
UUUU, xrefs: 6DD3E1C9
UUUU, xrefs: 6DD46AF1
UUUU, xrefs: 6DD51C14
UUUU, xrefs: 6DD5E83C
o]_@, xrefs: 6DD5E4ED
3333, xrefs: 6DD3D9B8
2333, xrefs: 6DD658B2
2333, xrefs: 6DD47246
UUUU, xrefs: 6DD5C8A6
3333, xrefs: 6DD3D1DF
o]_@, xrefs: 6DD56245
dAk, xrefs: 6DD65001
UUUU, xrefs: 6DD680DB
UUUU, xrefs: 6DD51F46
3333, xrefs: 6DD6417D
3333, xrefs: 6DD3EA83
3333, xrefs: 6DD52844
o]_@, xrefs: 6DD64B32
UUUU, xrefs: 6DD56BA2
dAk, xrefs: 6DD679AA
2333, xrefs: 6DD4B6C5
o]_@, xrefs: 6DD3C264
o]_@, xrefs: 6DD41851
3333, xrefs: 6DD5DAF9
o]_@, xrefs: 6DD66113
3333, xrefs: 6DD44A6A
dAk, xrefs: 6DD4FB7B
dAk, xrefs: 6DD61CA3
dAk, xrefs: 6DD40F24
UUUU, xrefs: 6DD5A6EA
UUUU, xrefs: 6DD5F3A2
dAk, xrefs: 6DD46D13
3333, xrefs: 6DD56BD0
UUUU, xrefs: 6DD435AC
o]_@, xrefs: 6DD62099
dAk, xrefs: 6DD4FF37
2333, xrefs: 6DD5C7BB
UUUU, xrefs: 6DD5F917
UUUU, xrefs: 6DD59544
dAk, xrefs: 6DD47E27
2333, xrefs: 6DD647DA
3333, xrefs: 6DD649F1
o]_@, xrefs: 6DD40613
3333, xrefs: 6DD62FDA
3333, xrefs: 6DD58523
UUUU, xrefs: 6DD6516F
UUUU, xrefs: 6DD4579E
dAk, xrefs: 6DD5152E
dAk, xrefs: 6DD3CF6F
3333, xrefs: 6DD415E9
o]_@, xrefs: 6DD547E4
UUUU, xrefs: 6DD6129D
dAk, xrefs: 6DD3FD36
2333, xrefs: 6DD5EA0E
dAk, xrefs: 6DD5543F
UUUU, xrefs: 6DD3FA67
o]_@, xrefs: 6DD40249
UUUU, xrefs: 6DD6679E
o]_@, xrefs: 6DD53F9F
o]_@, xrefs: 6DD3EB1B
UUUU, xrefs: 6DD58D0C
o]_@, xrefs: 6DD5A032
o]_@, xrefs: 6DD63728
2333, xrefs: 6DD4D948
3333, xrefs: 6DD45AFA
UUUU, xrefs: 6DD49B57
dAk, xrefs: 6DD4DD04
o]_@, xrefs: 6DD5A56B
o]_@, xrefs: 6DD3FD4F
dAk, xrefs: 6DD58F09
UUUU, xrefs: 6DD5BFE1
UUUU, xrefs: 6DD41EDE
dAk, xrefs: 6DD51D64
o]_@, xrefs: 6DD497FF
UUUU, xrefs: 6DD5462B
UUUU, xrefs: 6DD60CC4
3333, xrefs: 6DD5178F
2333, xrefs: 6DD40266
3333, xrefs: 6DD53908
3333, xrefs: 6DD563EC
dAk, xrefs: 6DD67D48
o]_@, xrefs: 6DD5F5CB
UUUU, xrefs: 6DD50566
3333, xrefs: 6DD56376
dAk, xrefs: 6DD5A8A9
UUUU, xrefs: 6DD5304F
UUUU, xrefs: 6DD46B60
3333, xrefs: 6DD4A7EE
UUUU, xrefs: 6DD5A678
3333, xrefs: 6DD54142
UUUU, xrefs: 6DD48480
2333, xrefs: 6DD60BD4
o]_@, xrefs: 6DD614CB
3333, xrefs: 6DD4E468
o]_@, xrefs: 6DD67A83
o]_@, xrefs: 6DD65394
UUUU, xrefs: 6DD54960
dAk, xrefs: 6DD54B51
dAk, xrefs: 6DD4322E
o]_@, xrefs: 6DD5FACB
L2L, xrefs: 6DD43A14
o]_@, xrefs: 6DD3F141
dAk, xrefs: 6DD4A0A0
o]_@, xrefs: 6DD4486A
dAk, xrefs: 6DD674D4
UUUU, xrefs: 6DD4B827
3333, xrefs: 6DD58596
2333, xrefs: 6DD4E251
3333, xrefs: 6DD43996
o]_@, xrefs: 6DD529A9
o]_@, xrefs: 6DD54B6A
o]_@, xrefs: 6DD5AE67
3333, xrefs: 6DD47CB1
o]_@, xrefs: 6DD6031D
o]_@, xrefs: 6DD5D8B8
3333, xrefs: 6DD527EA
o]_@, xrefs: 6DD5FB43
dAk, xrefs: 6DD6206A
dAk, xrefs: 6DD55C95
dAk, xrefs: 6DD51896
dAk, xrefs: 6DD4EA52
o]_@, xrefs: 6DD47AB4
2333, xrefs: 6DD62E54
UUUU, xrefs: 6DD5C053
dAk, xrefs: 6DD40AAC
dAk, xrefs: 6DD5E13D
dAk, xrefs: 6DD42099
UUUU, xrefs: 6DD62F44
3333, xrefs: 6DD63034
UUUU, xrefs: 6DD5E2AB
o]_@, xrefs: 6DD65C10
UUUU, xrefs: 6DD6599D
o]_@, xrefs: 6DD60F23
3333, xrefs: 6DD427DF
2333, xrefs: 6DD5D07D
UUUU, xrefs: 6DD67B1E
o]_@, xrefs: 6DD45C97
2333, xrefs: 6DD5E1BB
dAk, xrefs: 6DD5E98B
UUUU, xrefs: 6DD5794A
3333, xrefs: 6DD604C9
dAk, xrefs: 6DD4BA73
dAk, xrefs: 6DD471C5
o]_@, xrefs: 6DD472A1
2333, xrefs: 6DD625B6
o]_@, xrefs: 6DD4EAB3
3333, xrefs: 6DD3EA26
o]_@, xrefs: 6DD40B85
o]_@, xrefs: 6DD51062
3333, xrefs: 6DD67380
2333, xrefs: 6DD671F7
UUUU, xrefs: 6DD4F459
o]_@, xrefs: 6DD4297F
2333, xrefs: 6DD5B6AD
UUUU, xrefs: 6DD62C81
dAk, xrefs: 6DD60B56
dAk, xrefs: 6DD54B3B
dAk, xrefs: 6DD613EF
2333, xrefs: 6DD56A48
o]_@, xrefs: 6DD62EAF
UUUU, xrefs: 6DD5169F
3333, xrefs: 6DD5AF95
UUUU, xrefs: 6DD61E13
o]_@, xrefs: 6DD43FE5
dAk, xrefs: 6DD4D8C7
UUUU, xrefs: 6DD4525C
UUUU, xrefs: 6DD55176
o]_@, xrefs: 6DD3CFD3
dAk, xrefs: 6DD5D3A0
UUUU, xrefs: 6DD68410
dAk, xrefs: 6DD44321
o]_@, xrefs: 6DD3D051
o]_@, xrefs: 6DD504D7
UUUU, xrefs: 6DD4F196
dAk, xrefs: 6DD602BC
UUUU, xrefs: 6DD3F1D5
dAk, xrefs: 6DD6582F
dAk, xrefs: 6DD65BE1
o]_@, xrefs: 6DD637A0
dAk, xrefs: 6DD593D6
3333, xrefs: 6DD5DA55
dAk, xrefs: 6DD4A557
o]_@, xrefs: 6DD46D2C
dAk, xrefs: 6DD4D3E2
dAk, xrefs: 6DD66C73
2333, xrefs: 6DD52EF0
UUUU, xrefs: 6DD4D772
2333, xrefs: 6DD4C884
UUUU, xrefs: 6DD52D20
3333, xrefs: 6DD45B54
o]_@, xrefs: 6DD49D8E
dAk, xrefs: 6DD5DC3E
UUUU, xrefs: 6DD52751
UUUU, xrefs: 6DD56348
o]_@, xrefs: 6DD647BB
UUUU, xrefs: 6DD3C8B1
dAk, xrefs: 6DD5F59C
o]_@, xrefs: 6DD3C816
dAk, xrefs: 6DD685DA
o]_@, xrefs: 6DD66452
UUUU, xrefs: 6DD50B50
dAk, xrefs: 6DD5D854
dAk, xrefs: 6DD497E3
UUUU, xrefs: 6DD495D0
3333, xrefs: 6DD3F272
dAk, xrefs: 6DD3E816
3333, xrefs: 6DD5E39B
dAk, xrefs: 6DD674EA
UUUU, xrefs: 6DD4A734
dAk, xrefs: 6DD6537B
o]_@, xrefs: 6DD597A0
dAk, xrefs: 6DD66439
UUUU, xrefs: 6DD548EE
dAk, xrefs: 6DD5E4D4

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: `m$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$L2L$L2L$L2L$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@
API String ID: 4275171209-2899388138
Opcode ID: 6f1b39d47018f21ce37db01e39229c11fe7f48b3f962ac77082dac5e9c9da033
Instruction ID: 777d80c91b6752786f368451aee267b7ad370227478ae84849cdfce15c452967
Opcode Fuzzy Hash: 6f1b39d47018f21ce37db01e39229c11fe7f48b3f962ac77082dac5e9c9da033
Instruction Fuzzy Hash: 8C74C474718642CBCB65EB2C818462EB7E2ABD5350F60CD1AF4D6CB369E635DC428B43

Uniqueness

Uniqueness Score: -1.00%

Function 047F1010, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E047F1010() {
				_Unknown_base(*)()* _v8;
				void* _v12;
				struct tagMSG _v40;
				long _v44;
				struct HWND__* _v48;
				long _v52;
				void* _v56;
				void* _t39;
				void* _t44;
				int _t46;
				long _t48;

				SetTimer(0, 0, 0x25b, 0); // executed
				while(GetMessageW( &_v40, 0, 0, 0) != 0) {
					_v40.message = _v40.message + 1;
					if(_v40.message != 0x114) {
						DispatchMessageW( &_v40);
						continue;
					} else {
					}
					break;
				}
				_v12 = 0;
				_v48 = 0;
				_v52 = 0x5000;
				while(_v52 > 0x1000) {
					_v52 = _v52 - 1;
				}
				_v44 = _v52;
				while(_v44 > 0x40) {
					_v44 = _v44 - 1;
				}
				do {
					_t39 = VirtualAlloc(_v12, 0x43000, _v52, _v44); // executed
					_v8 = _t39;
					if(_v8 == 0) {
						Sleep(0x1f4);
					}
				} while (_v8 == 0);
				_v48 =  &(_v48->i);
				E048234C0(_v48, _v8);
				_t44 = CreateThread(0, 0, _v8, 1, 0, 0); // executed
				_v56 = _t44;
				_push(0);
				_push(0x2000);
				 *_t44 = _t44 +  *_t44;
				SetTimer(0, 0, ??, ??); // executed
				while(1) {
					_push(0);
					_push(0);
					_push(0);
					_push( &_v40);
					_t46 = GetMessageW();
					if(_t46 != 0) {
						_v40.message = _v40.message + 1;
						if(_v40.message == 0x114) {
							return _t46;
						}
						_t48 = DispatchMessageW( &_v40);
						 *((intOrPtr*)(_t48 - 0x7e)) = es;
						_t46 = _t48 + 0xeb;
						asm("int3");
						continue;
					}
					return _t46;
				}
			}

0x047f1021
0x047f1027
0x047f1041
0x047f104b
0x047f1053
0x00000000
0x00000000
0x047f104d
0x00000000
0x047f104b
0x047f105b
0x047f1062
0x047f1069
0x047f1070
0x047f107f
0x047f107f
0x047f1087
0x047f108a
0x047f1096
0x047f1096
0x047f109b
0x047f10ac
0x047f10b2
0x047f10b9
0x047f10c0
0x047f10c0
0x047f10c6
0x047f10d2
0x047f10dd
0x047f10f0
0x047f10f6
0x047f10f9
0x047f10fb
0x047f10fe
0x047f1104
0x047f110a
0x047f110a
0x047f110c
0x047f110e
0x047f1113
0x047f1114
0x047f111c
0x047f1124
0x047f112e
0x00000000
0x00000000
0x047f1136
0x047f1138
0x047f113b
0x047f113d
0x00000000
0x047f113d
0x047f1141
0x047f1141

APIs

SetTimer.USER32(00000000,00000000,0000025B,00000000), ref: 047F1021
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 047F1031
DispatchMessageW.USER32 ref: 047F1053
VirtualAlloc.KERNELBASE(00000000,00043000,00001000,00000040), ref: 047F10AC
Sleep.KERNEL32(000001F4), ref: 047F10C0
CreateThread.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000), ref: 047F10F0
SetTimer.USER32(00000000,00000000,00002000,00000000), ref: 047F1104
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 047F1114
DispatchMessageW.USER32 ref: 047F1136

Strings

@, xrefs: 047F108A

Memory Dump Source

Source File: 00000004.00000002.342880872.00000000047F0000.00000040.00000001.sdmp, Offset: 047F0000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer$AllocCreateSleepThreadVirtual
String ID: @
API String ID: 368155642-2766056989
Opcode ID: 1fe27cf6ba52a81d6c668f95016c6fa2fb333dd5b4e8b11a6196d1240f082a6c
Instruction ID: 7a43a66a2ccb0bf982c25c24613c88f775b4a2730fdc639d59845d8fb362cc7a
Opcode Fuzzy Hash: 1fe27cf6ba52a81d6c668f95016c6fa2fb333dd5b4e8b11a6196d1240f082a6c
Instruction Fuzzy Hash: 9D411A70A44218EBEB20DFA4DD49FEDB7B4FB48B05F508518E601BA3C0D7B6A940DB24

Uniqueness

Uniqueness Score: -1.00%

Function 047F1151, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 254windowtimeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000000,00000000,00002000,00000000), ref: 047F1104
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 047F1114
DispatchMessageW.USER32 ref: 047F1136

Strings

x _n, xrefs: 047F1151

Memory Dump Source

Source File: 00000004.00000002.342880872.00000000047F0000.00000040.00000001.sdmp, Offset: 047F0000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer
String ID: x _n
API String ID: 2110285445-548084811
Opcode ID: def137d7836d59fe9bc4d84b5b642cf4cfef06fc3029cab23a2a57f649e88ffc
Instruction ID: 2995f84ca1b6e3c13afe8a734fbf9f1fd454d1b2f48c68df025f4853932ae57e
Opcode Fuzzy Hash: def137d7836d59fe9bc4d84b5b642cf4cfef06fc3029cab23a2a57f649e88ffc
Instruction Fuzzy Hash: 0D81A772A08255CFDB21CFA4CE897D9BBB1EB42710F84459EE210AB393C3707902CB95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD7260C, Relevance: 624.9, Strings: 486, Instructions: 17401COMMON

Download Yara Rule

Strings

*`, xrefs: 6DD76084
k, xrefs: 6DD7DEA4
k, xrefs: 6DD80561
UUUU, xrefs: 6DD73162
2333, xrefs: 6DD7A421
*`, xrefs: 6DD80C21
UUUU, xrefs: 6DD7B440
2333, xrefs: 6DD788CE
j, xrefs: 6DD7BD92
98E, xrefs: 6DD77628
j, xrefs: 6DD75017
k, xrefs: 6DD7BB5D
k, xrefs: 6DD769E2
2333, xrefs: 6DD822D2
98E, xrefs: 6DD73EE6
98E, xrefs: 6DD77EE3
2333, xrefs: 6DD73F0E
k, xrefs: 6DD72722
k, xrefs: 6DD7F31C
j, xrefs: 6DD77DE9
k, xrefs: 6DD77547
98E, xrefs: 6DD80F63
*`, xrefs: 6DD7A89E
2333, xrefs: 6DD7BFA4
UUUU, xrefs: 6DD74537
k, xrefs: 6DD7B468
3333, xrefs: 6DD72DA8
UUUU, xrefs: 6DD7D42A
*`, xrefs: 6DD81314
j, xrefs: 6DD762BF
j, xrefs: 6DD78FF8
3333, xrefs: 6DD77F59
UUUU, xrefs: 6DD7B94C
k, xrefs: 6DD760C8
*`, xrefs: 6DD74DCC
3333, xrefs: 6DD73E69
UUUU, xrefs: 6DD741ED
UUUU, xrefs: 6DD7295D
k, xrefs: 6DD80E82
3333, xrefs: 6DD7D4A3
2333, xrefs: 6DD7483E
UUUU, xrefs: 6DD767BF
j, xrefs: 6DD7CF36
{,d, xrefs: 6DD7386F
*`, xrefs: 6DD78B61
UUUU, xrefs: 6DD7461A
UUUU, xrefs: 6DD76C05
3333, xrefs: 6DD74799
98E, xrefs: 6DD7A3F9
j, xrefs: 6DD8054B
k, xrefs: 6DD73032
*`, xrefs: 6DD7F0BB
98E, xrefs: 6DD83407
3333, xrefs: 6DD77181
98E, xrefs: 6DD7EBA7
2333, xrefs: 6DD8107E
UUUU, xrefs: 6DD7AFD6
*`, xrefs: 6DD73A80
UUUU, xrefs: 6DD76B25
UUUU, xrefs: 6DD797FC
98E, xrefs: 6DD7510E
UUUU, xrefs: 6DD737C0
UUUU, xrefs: 6DD83EBC
k, xrefs: 6DD786CF
*`, xrefs: 6DD7F7B1
98E, xrefs: 6DD8196E
k, xrefs: 6DD7E0D2
*`, xrefs: 6DD83E0F
UUUU, xrefs: 6DD7B35D
*`, xrefs: 6DD7BCD3
*`, xrefs: 6DD809F3
UUUU, xrefs: 6DD843C8
98E, xrefs: 6DD7B549
k, xrefs: 6DD73270
k, xrefs: 6DD78DB2
*`, xrefs: 6DD7CCBD
UUUU, xrefs: 6DD80539
*`, xrefs: 6DD7E8FE
*`, xrefs: 6DD770B6
3333, xrefs: 6DD74266
j, xrefs: 6DD7F306
*`, xrefs: 6DD7DFFA
1\4, xrefs: 6DD73831
*`, xrefs: 6DD7676D
UUUU, xrefs: 6DD7C625
98E, xrefs: 6DD75B08
*`, xrefs: 6DD79D96
UUUU, xrefs: 6DD8321E
3333, xrefs: 6DD7769E
*`, xrefs: 6DD7EE5F
k, xrefs: 6DD7D5D4
98E, xrefs: 6DD75201
3333, xrefs: 6DD78829
*`, xrefs: 6DD7B390
UUUU, xrefs: 6DD77CF4
*`, xrefs: 6DD7FBC8
3333, xrefs: 6DD78C2C
UUUU, xrefs: 6DD78BB0
*`, xrefs: 6DD78F39
UUUU, xrefs: 6DD7F211
k, xrefs: 6DD73AB3
k, xrefs: 6DD7E788
k, xrefs: 6DD83CB9
3333, xrefs: 6DD7F87F
98E, xrefs: 6DD80735
k, xrefs: 6DD81E8B
k, xrefs: 6DD8034C
3333, xrefs: 6DD83877
98E, xrefs: 6DD82AE3
*`, xrefs: 6DD82001
3333, xrefs: 6DD72ADF
*`, xrefs: 6DD7E570
*`, xrefs: 6DD816C2
k, xrefs: 6DD830DB
UUUU, xrefs: 6DD837FE
UUUU, xrefs: 6DD7A1FD
98E, xrefs: 6DD75A15
k, xrefs: 6DD772EB
j, xrefs: 6DD7D81A
*`, xrefs: 6DD83097
2333, xrefs: 6DD75229
3333, xrefs: 6DD7835F
UUUU, xrefs: 6DD80E5A
j, xrefs: 6DD84822
UUUU, xrefs: 6DD782E3
*`, xrefs: 6DD743E1
UUUU, xrefs: 6DD7AAC7
k, xrefs: 6DD820D6
98E, xrefs: 6DD763B9
3333, xrefs: 6DD8222D
UUUU, xrefs: 6DD7DFC7
98E, xrefs: 6DD791E5
*`, xrefs: 6DD74F55
UUUU, xrefs: 6DD7EEAE
j, xrefs: 6DD77531
j, xrefs: 6DD73CF9
UUUU, xrefs: 6DD72EDB
*`, xrefs: 6DD7C575
3333, xrefs: 6DD77A9B
3333, xrefs: 6DD8262A
3333, xrefs: 6DD7EF27
2333, xrefs: 6DD77FFE
1\4, xrefs: 6DD74CCE
98E, xrefs: 6DD7EAB4
UUUU, xrefs: 6DD8168F
UUUU, xrefs: 6DD81FCE
98E, xrefs: 6DD83FC5
k, xrefs: 6DD80C65
k, xrefs: 6DD827AE
2333, xrefs: 6DD81996
k, xrefs: 6DD7CCF0
*`, xrefs: 6DD7699E
UUUU, xrefs: 6DD77A22
k, xrefs: 6DD7AAEF
j, xrefs: 6DD7A20F
k, xrefs: 6DD8156C
k, xrefs: 6DD7C41F
98E, xrefs: 6DD7E1B6
3333, xrefs: 6DD7B9C8
k, xrefs: 6DD7F0EE
k, xrefs: 6DD796B9
2333, xrefs: 6DD7EBCF
98E, xrefs: 6DD7C731
98E, xrefs: 6DD799E8
*`, xrefs: 6DD78294
UUUU, xrefs: 6DD84810
UUUU, xrefs: 6DD832FE
k, xrefs: 6DD7CD01
k, xrefs: 6DD83326
98E, xrefs: 6DD7FE74
98E, xrefs: 6DD74723
{,d, xrefs: 6DD7EFB8
98E, xrefs: 6DD7D911
k, xrefs: 6DD78DC3
98E, xrefs: 6DD79ADB
UUUU, xrefs: 6DD73CE7
*`, xrefs: 6DD7B207
j, xrefs: 6DD7E0BC
98E, xrefs: 6DD7D030
*`, xrefs: 6DD7E744
k, xrefs: 6DD7B24B
k, xrefs: 6DD75717
j, xrefs: 6DD83310
*`, xrefs: 6DD84CCA
j, xrefs: 6DD76C17
UUUU, xrefs: 6DD7D728
3333, xrefs: 6DD7E22C
2333, xrefs: 6DD7F518
k, xrefs: 6DD8033B
*`, xrefs: 6DD73C3A
UUUU, xrefs: 6DD7E9AB
*`, xrefs: 6DD82927
3333, xrefs: 6DD7DD84
k, xrefs: 6DD784B2
3333, xrefs: 6DD7683B
*`, xrefs: 6DD81539
2333, xrefs: 6DD7E2D1
*`, xrefs: 6DD79675
*`, xrefs: 6DD82E94
3333, xrefs: 6DD7EB2A
2333, xrefs: 6DD7D14B
98E, xrefs: 6DD7A306
2333, xrefs: 6DD7B664
3333, xrefs: 6DD7B5BF
k, xrefs: 6DD7A225
UUUU, xrefs: 6DD7CE44
UUUU, xrefs: 6DD73C07
3333, xrefs: 6DD82F5C
*`, xrefs: 6DD72E89
k, xrefs: 6DD7FA72
*`, xrefs: 6DD845A6
UUUU, xrefs: 6DD7590C
98E, xrefs: 6DD7F4F0
98E, xrefs: 6DD73357
k, xrefs: 6DD8179A
2333, xrefs: 6DD764D4
UUUU, xrefs: 6DD7CF24
98E, xrefs: 6DD790F2
98E, xrefs: 6DD787B3
k, xrefs: 6DD77DFF
*`, xrefs: 6DD7A6C0
98E, xrefs: 6DD7FD81
UUUU, xrefs: 6DD80D77
*`, xrefs: 6DD7DE71
*`, xrefs: 6DD754C2
3333, xrefs: 6DD7F473
*`, xrefs: 6DD80DAA
j, xrefs: 6DD829E9
*`, xrefs: 6DD7AF84
k, xrefs: 6DD784A1
k, xrefs: 6DD8279D
3333, xrefs: 6DD79E5E
j, xrefs: 6DD83ECE
98E, xrefs: 6DD7ABD0
k, xrefs: 6DD72985
j, xrefs: 6DD7AAD9
UUUU, xrefs: 6DD7751F
2333, xrefs: 6DD76E29
Vmt, xrefs: 6DD74C57
98E, xrefs: 6DD7D123
*`, xrefs: 6DD84379
*`, xrefs: 6DD7419E
j, xrefs: 6DD80E6C
*`, xrefs: 6DD76B58
*`, xrefs: 6DD7456A
3333, xrefs: 6DD7956B
3333, xrefs: 6DD813DF
98E, xrefs: 6DD8187B
k, xrefs: 6DD772FC
j, xrefs: 6DD7FC8A
k, xrefs: 6DD829FF
2333, xrefs: 6DD77743
UUUU, xrefs: 6DD798DC
j, xrefs: 6DD7462C
k, xrefs: 6DD7C430
UUUU, xrefs: 6DD81363
3333, xrefs: 6DD74B9C
UUUU, xrefs: 6DD74F22
3333, xrefs: 6DD7E63B
2333, xrefs: 6DD7FE9C
3333, xrefs: 6DD7C7A7
UUUU, xrefs: 6DD829D7
3333, xrefs: 6DD7D0A6
UUUU, xrefs: 6DD75005
*`, xrefs: 6DD7585C
*`, xrefs: 6DD82562
*`, xrefs: 6DD772B8
UUUU, xrefs: 6DD7E8CB
k, xrefs: 6DD74642
3333, xrefs: 6DD75A8B
*`, xrefs: 6DD7846E
3333, xrefs: 6DD80FD9
UUUU, xrefs: 6DD7E0AA
k, xrefs: 6DD762D5
*`, xrefs: 6DD7A14D
UUUU, xrefs: 6DD73248
3333, xrefs: 6DD7A37C
k, xrefs: 6DD73AC4
3333, xrefs: 6DD81CFD
*`, xrefs: 6DD761FD
2333, xrefs: 6DD7920D
k, xrefs: 6DD7BB4C
3333, xrefs: 6DD79168
k, xrefs: 6DD73D0F
3333, xrefs: 6DD80ABE
*`, xrefs: 6DD83251
k, xrefs: 6DD83CCA
98E, xrefs: 6DD7771B
2333, xrefs: 6DD83522
2333, xrefs: 6DD7ACEB
*`, xrefs: 6DD7C3EC
UUUU, xrefs: 6DD828F4
98E, xrefs: 6DD7F3FD
UUUU, xrefs: 6DD7A11A
*`, xrefs: 6DD79FC4
UUUU, xrefs: 6DD77DD7
UUUU, xrefs: 6DD78FE6
UUUU, xrefs: 6DD75829
UUUU, xrefs: 6DD785C4
2333, xrefs: 6DD73478
j, xrefs: 6DD786B9
3333, xrefs: 6DD7FDF7
k, xrefs: 6DD7BDA8
k, xrefs: 6DD79904
k, xrefs: 6DD845EA
*`, xrefs: 6DD8276A
UUUU, xrefs: 6DD7CB3A
UUUU, xrefs: 6DD7F2F4
UUUU, xrefs: 6DD7C286
UUUU, xrefs: 6DD825B1
UUUU, xrefs: 6DD78F06
*`, xrefs: 6DD81C2F
UUUU, xrefs: 6DD762AD
UUUU, xrefs: 6DD7743F
*`, xrefs: 6DD77472
k, xrefs: 6DD7CF4C
UUUU, xrefs: 6DD794F2
k, xrefs: 6DD77BE2
*`, xrefs: 6DD756D3
k, xrefs: 6DD74DFF
2333, xrefs: 6DD75B30
98E, xrefs: 6DD82BD6
3333, xrefs: 6DD8498F
k, xrefs: 6DD83EE4
j, xrefs: 6DD7325A
k, xrefs: 6DD830CA
UUUU, xrefs: 6DD820AE
*`, xrefs: 6DD779D3
3333, xrefs: 6DD7A78E
UUUU, xrefs: 6DD79DE5
3333, xrefs: 6DD82B59
2333, xrefs: 6DD79B03
k, xrefs: 6DD7900E
*`, xrefs: 6DD7D3D8
98E, xrefs: 6DD76E01
*`, xrefs: 6DD7F244
98E, xrefs: 6DD74816
3333, xrefs: 6DD75184
UUUU, xrefs: 6DD7FC78
98E, xrefs: 6DD84919
2333, xrefs: 6DD8075D
98E, xrefs: 6DD7DA04
j, xrefs: 6DD7E9BD
3333, xrefs: 6DD7C2FF
UUUU, xrefs: 6DD7DD0B
3333, xrefs: 6DD818F1
2333, xrefs: 6DD72B8A
*`, xrefs: 6DD7DCBC
UUUU, xrefs: 6DD81772
3333, xrefs: 6DD7B052
*`, xrefs: 6DD726F4
UUUU, xrefs: 6DD786A7
k, xrefs: 6DD74425
*`, xrefs: 6DD83C86
UUUU, xrefs: 6DD7BCA0
3333, xrefs: 6DD806B8
k, xrefs: 6DD7A008
k, xrefs: 6DD7A8E2
*`, xrefs: 6DD7CAEB
98E, xrefs: 6DD764AC
*`, xrefs: 6DD7B8FD
*`, xrefs: 6DD74AD1
UUUU, xrefs: 6DD84D1C
98E, xrefs: 6DD822AA
3333, xrefs: 6DD73698
UUUU, xrefs: 6DD761CA
3333, xrefs: 6DD76D84
3333, xrefs: 6DD75E9A
1\4, xrefs: 6DD79E77
*`, xrefs: 6DD80489
*`, xrefs: 6DD78D7F
UUUU, xrefs: 6DD81C81
UUUU, xrefs: 6DD74B20
*`, xrefs: 6DD7AA17
3333, xrefs: 6DD7CBB6
UUUU, xrefs: 6DD7A712
2333, xrefs: 6DD84A34
UUUU, xrefs: 6DD75E1E
k, xrefs: 6DD79FF7
UUUU, xrefs: 6DD7A9E4
z,d, xrefs: 6DD755E1
j, xrefs: 6DD820C0
UUUU, xrefs: 6DD7F803
UUUU, xrefs: 6DD84730
UUUU, xrefs: 6DD80184
3333, xrefs: 6DD80200
j, xrefs: 6DD81784
*`, xrefs: 6DD7D75B
98E, xrefs: 6DD840B8
k, xrefs: 6DD84838
k, xrefs: 6DD74414
UUUU, xrefs: 6DD80A42
2333, xrefs: 6DD82BFE
*`, xrefs: 6DD84763
98E, xrefs: 6DD7ACC3
UUUU, xrefs: 6DD7E5BF
k, xrefs: 6DD81E7A
*`, xrefs: 6DD728AA
k, xrefs: 6DD77BD1
UUUU, xrefs: 6DD82EE3
k, xrefs: 6DD8157D
k, xrefs: 6DD760B7
98E, xrefs: 6DD7BE89
UUUU, xrefs: 6DD7BD80
*`, xrefs: 6DD81E47
2333, xrefs: 6DD7C84C
98E, xrefs: 6DD84A0C
k, xrefs: 6DD74E10
j, xrefs: 6DD7B452
98E, xrefs: 6DD77FD6
k, xrefs: 6DD7D830
k, xrefs: 6DD76C2D
98E, xrefs: 6DD834FA
j, xrefs: 6DD7C637
k, xrefs: 6DD7F0FF
98E, xrefs: 6DD76D0E
3333, xrefs: 6DD733CD
98E, xrefs: 6DD788A6
98E, xrefs: 6DD80642
*`, xrefs: 6DD7BB19
3333, xrefs: 6DD7AC46
k, xrefs: 6DD7A8D1
k, xrefs: 6DD7E777
UUUU, xrefs: 6DD83DDC
3333, xrefs: 6DD84D98
*`, xrefs: 6DD7D5A1
3333, xrefs: 6DD84441
98E, xrefs: 6DD73450
*`, xrefs: 6DD75DCC
*`, xrefs: 6DD7FA3F
*`, xrefs: 6DD794A0
98E, xrefs: 6DD72A69
98E, xrefs: 6DD7C824
98E, xrefs: 6DD81056
k, xrefs: 6DD7FCA0
k, xrefs: 6DD80C54
*`, xrefs: 6DD80132
98E, xrefs: 6DD72B62
98E, xrefs: 6DD7B63C
98E, xrefs: 6DD7E2A9
k, xrefs: 6DD75934
UUUU, xrefs: 6DD72877
98E, xrefs: 6DD73DF3
k, xrefs: 6DD845D9
*`, xrefs: 6DD785F7
UUUU, xrefs: 6DD77108
2333, xrefs: 6DD7DA2C
3333, xrefs: 6DD8347D
UUUU, xrefs: 6DD80456
UUUU, xrefs: 6DD7FB95
k, xrefs: 6DD7C64D
*`, xrefs: 6DD73771
j, xrefs: 6DD7591E
k, xrefs: 6DD75706
3333, xrefs: 6DD7642F
*`, xrefs: 6DD77B9E
98E, xrefs: 6DD7BF7C
j, xrefs: 6DD7296F
UUUU, xrefs: 6DD75511
98E, xrefs: 6DD821B7
*`, xrefs: 6DD80308
k, xrefs: 6DD7E9D3
k, xrefs: 6DD769D1
3333, xrefs: 6DD7D987
*`, xrefs: 6DD7982F
UUUU, xrefs: 6DD7D808
2333, xrefs: 6DD840E0
k, xrefs: 6DD7FA83
3333, xrefs: 6DD7BEFF
*`, xrefs: 6DD73004
k, xrefs: 6DD7D5E5
k, xrefs: 6DD796A8
k, xrefs: 6DD7B23A
*`, xrefs: 6DD837AF
k, xrefs: 6DD7502D
k, xrefs: 6DD7DEB5
{,d, xrefs: 6DD79EDA
3333, xrefs: 6DD8403B
*`, xrefs: 6DD7C237
UUUU, xrefs: 6DD7C542
*`, xrefs: 6DD77D27
3333, xrefs: 6DD7558D
j, xrefs: 6DD798EE
*`, xrefs: 6DD7CE77
3333, xrefs: 6DD79A5E
*`, xrefs: 6DD73195

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Vmt$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$z,d${,d${,d${,d$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$1\4$1\4$1\4
API String ID: 0-2620893897
Opcode ID: 9f8409fce7a8110c04bd6c4ced138ccdd4ec486fab7a84df6c1352528653abdb
Instruction ID: 3acb44678e9fb9c77ef6a521d3c0489b0b024ceeaac1baa51be2be1c99af0819
Opcode Fuzzy Hash: 9f8409fce7a8110c04bd6c4ced138ccdd4ec486fab7a84df6c1352528653abdb
Instruction Fuzzy Hash: 4C54A071B18242CFCB35AB2C849062EB6E2ABD9344F64CD5AF4D9CB355E635CC468B43

Uniqueness

Uniqueness Score: -1.00%

Function 6DD84DDD, Relevance: 212.2, Strings: 165, Instructions: 5974COMMON

Download Yara Rule

Strings

*`, xrefs: 6DD89838
j, xrefs: 6DD87642
UUUU, xrefs: 6DD87F61
k, xrefs: 6DD8623A
j, xrefs: 6DD87F73
*`, xrefs: 6DD8A292
3333, xrefs: 6DD8A4C1
98E, xrefs: 6DD85441
k, xrefs: 6DD86B6C
k, xrefs: 6DD8A36A
UUUU, xrefs: 6DD8645D
k, xrefs: 6DD891C1
3333, xrefs: 6DD857C4
k, xrefs: 6DD88F65
k, xrefs: 6DD88886
*`, xrefs: 6DD84FDE
k, xrefs: 6DD8863B
UUUU, xrefs: 6DD899BB
98E, xrefs: 6DD8773C
k, xrefs: 6DD85011
j, xrefs: 6DD891AB
*`, xrefs: 6DD8964A
UUUU, xrefs: 6DD87E7E
UUUU, xrefs: 6DD8637D
*`, xrefs: 6DD88F32
j, xrefs: 6DD85257
UUUU, xrefs: 6DD89F9B
98E, xrefs: 6DD8ADAA
3333, xrefs: 6DD8730A
UUUU, xrefs: 6DD86CAB
*`, xrefs: 6DD8AA3A
UUUU, xrefs: 6DD88476
98E, xrefs: 6DD85C20
UUUU, xrefs: 6DD85245
2333, xrefs: 6DD86681
*`, xrefs: 6DD8690E
*`, xrefs: 6DD8A109
k, xrefs: 6DD89AC3
98E, xrefs: 6DD86E94
98E, xrefs: 6DD892A2
2333, xrefs: 6DD85469
UUUU, xrefs: 6DD8A25F
UUUU, xrefs: 6DD85B17
*`, xrefs: 6DD85A67
98E, xrefs: 6DD89395
*`, xrefs: 6DD856F9
k, xrefs: 6DD8743B
k, xrefs: 6DD86B5B
3333, xrefs: 6DD865DC
*`, xrefs: 6DD87AF9
*`, xrefs: 6DD85FDD
98E, xrefs: 6DD85D13
3333, xrefs: 6DD85C96
3333, xrefs: 6DD860AB
k, xrefs: 6DD8AA7E
k, xrefs: 6DD8526D
3333, xrefs: 6DD889DD
j, xrefs: 6DD89AAD
UUUU, xrefs: 6DD88D61
98E, xrefs: 6DD89C97
UUUU, xrefs: 6DD8602F
98E, xrefs: 6DD8782F
j, xrefs: 6DD8ACB3
j, xrefs: 6DD86D9D
UUUU, xrefs: 6DD8754D
3333, xrefs: 6DD87BC4
k, xrefs: 6DD8ACC9
*`, xrefs: 6DD85198
98E, xrefs: 6DD8815D
k, xrefs: 6DD88F76
3333, xrefs: 6DD8A014
2333, xrefs: 6DD88A82
98E, xrefs: 6DD86F87
k, xrefs: 6DD85911
98E, xrefs: 6DD8806A
3333, xrefs: 6DD8B21A
3333, xrefs: 6DD869D6
k, xrefs: 6DD85022
2333, xrefs: 6DD8AEC5
UUUU, xrefs: 6DD8877E
*`, xrefs: 6DD87580
*`, xrefs: 6DD8723F
2333, xrefs: 6DD85D3B
k, xrefs: 6DD8862A
j, xrefs: 6DD8A354
*`, xrefs: 6DD89F4C
k, xrefs: 6DD87D7C
98E, xrefs: 6DD88967
k, xrefs: 6DD87F89
k, xrefs: 6DD8A13C
2333, xrefs: 6DD87857
UUUU, xrefs: 6DD8574B
j, xrefs: 6DD85B29
*`, xrefs: 6DD88427
*`, xrefs: 6DD861F6
3333, xrefs: 6DD877B2
k, xrefs: 6DD87658
*`, xrefs: 6DD86B28
*`, xrefs: 6DD86CDE
j, xrefs: 6DD88870
UUUU, xrefs: 6DD8969C
3333, xrefs: 6DD8A8D3
3333, xrefs: 6DD880E0
UUUU, xrefs: 6DD8885E
*`, xrefs: 6DD899EE
UUUU, xrefs: 6DD87630
*`, xrefs: 6DD87D38
98E, xrefs: 6DD88A5A
UUUU, xrefs: 6DD8A342
k, xrefs: 6DD86DB3
98E, xrefs: 6DD8534E
3333, xrefs: 6DD89715
2333, xrefs: 6DD89CBF
UUUU, xrefs: 6DD87B48
k, xrefs: 6DD85B3F
*`, xrefs: 6DD885F7
k, xrefs: 6DD86485
3333, xrefs: 6DD86F0A
2333, xrefs: 6DD893BD
*`, xrefs: 6DD890EC
UUUU, xrefs: 6DD890B9
UUUU, xrefs: 6DD86D8B
98E, xrefs: 6DD8A44B
UUUU, xrefs: 6DD87291
k, xrefs: 6DD8742A
k, xrefs: 6DD8AA6D
98E, xrefs: 6DD8A53E
k, xrefs: 6DD85922
UUUU, xrefs: 6DD8695D
*`, xrefs: 6DD88D0F
*`, xrefs: 6DD858DE
*`, xrefs: 6DD8A808
UUUU, xrefs: 6DD8ACA1
UUUU, xrefs: 6DD8B1A1
UUUU, xrefs: 6DD8A857
k, xrefs: 6DD87D6B
3333, xrefs: 6DD884F2
UUUU, xrefs: 6DD89A9B
3333, xrefs: 6DD89C1A
*`, xrefs: 6DD8B152
k, xrefs: 6DD8987C
98E, xrefs: 6DD86566
2333, xrefs: 6DD88185
3333, xrefs: 6DD89318
k, xrefs: 6DD8A14D
3333, xrefs: 6DD853C4
j, xrefs: 6DD8646F
*`, xrefs: 6DD873F7
UUUU, xrefs: 6DD85165
k, xrefs: 6DD86229
2333, xrefs: 6DD8A566
2333, xrefs: 6DD86FAF
*`, xrefs: 6DD887B1
98E, xrefs: 6DD86659
98E, xrefs: 6DD8AE9D
3333, xrefs: 6DD88DDA
98E, xrefs: 6DD89BA4
UUUU, xrefs: 6DD85A34
k, xrefs: 6DD8986B
*`, xrefs: 6DD8ABF4
UUUU, xrefs: 6DD8ABC1
UUUU, xrefs: 6DD89199
3333, xrefs: 6DD8AE20
*`, xrefs: 6DD863B0
*`, xrefs: 6DD87EB1

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$2333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$3333$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$98E$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$j$j$j$j$j$j$j$j$j$j$j$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`$*`
API String ID: 0-1377154473
Opcode ID: 5b196ff4bb905feb8709c6d4fb573fed1a05261bb0f2f556141e730a0c59e3c0
Instruction ID: 3a642f56bd93df84d38f7222d0026f77fa4896057275d012ac9c4eaaa8c35ca5
Opcode Fuzzy Hash: 5b196ff4bb905feb8709c6d4fb573fed1a05261bb0f2f556141e730a0c59e3c0
Instruction Fuzzy Hash: 36A38171B1C242DBCB16AB2C849062EB6F2ABD5350F64CD1AF4D6CB356E635DC428B43

Uniqueness

Uniqueness Score: -1.00%

Function 6DD321C0, Relevance: 41.4, Strings: 32, Instructions: 1350COMMON

Download Yara Rule

Strings

3333, xrefs: 6DD3313C
3333, xrefs: 6DD349C7
dAk, xrefs: 6DD35387
o]_@, xrefs: 6DD33AC0
3333, xrefs: 6DD3626B
o]_@, xrefs: 6DD35312
o]_@, xrefs: 6DD35B44
dAk, xrefs: 6DD342FF
dAk, xrefs: 6DD326F3
o]_@, xrefs: 6DD33238
3333, xrefs: 6DD3520D
dAk, xrefs: 6DD35837
3333, xrefs: 6DD328FA
dAk, xrefs: 6DD33AEA
o]_@, xrefs: 6DD32225
dAk, xrefs: 6DD33F8E
dAk, xrefs: 6DD34B62
dAk, xrefs: 6DD347B7
o]_@, xrefs: 6DD3428F
dAk, xrefs: 6DD35BC0
dAk, xrefs: 6DD33753
dAk, xrefs: 6DD3224F
dAk, xrefs: 6DD35003
dAk, xrefs: 6DD32A70
3333, xrefs: 6DD33960
dAk, xrefs: 6DD32F2C
3333, xrefs: 6DD35A3B
dAk, xrefs: 6DD36061
dAk, xrefs: 6DD332A0
3333, xrefs: 6DD3418F
o]_@, xrefs: 6DD34AC4
o]_@, xrefs: 6DD329FE

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 3333$3333$3333$3333$3333$3333$3333$3333$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$dAk$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@
API String ID: 0-2738199901
Opcode ID: 9db625234e4c0e13ab54d7cee4578ef3296ab78cfcaf13717f61c44704702938
Instruction ID: 606fd092be01e1fd8eecae228a3e6a923b5e64082510a93420ee39f1ac7b8659
Opcode Fuzzy Hash: 9db625234e4c0e13ab54d7cee4578ef3296ab78cfcaf13717f61c44704702938
Instruction Fuzzy Hash: 9BB2B474708356DFCB58DF2C849062EB6E2ABDA344F618D2DF496CB364E634DC418B86

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31000, Relevance: 31.1, Strings: 24, Instructions: 1075COMMON

Download Yara Rule

Strings

UUUU, xrefs: 6DD31D54
UUUU, xrefs: 6DD3181D
3333, xrefs: 6DD32122
dAk, xrefs: 6DD319D8
2333, xrefs: 6DD31F2A
o]_@, xrefs: 6DD31716
dAk, xrefs: 6DD3117F
dAk, xrefs: 6DD31169
o]_@, xrefs: 6DD31A07
UUUU, xrefs: 6DD32089
o]_@, xrefs: 6DD31198
3333, xrefs: 6DD31844
3333, xrefs: 6DD320B0
2333, xrefs: 6DD316BB
3333, xrefs: 6DD318B6
o]_@, xrefs: 6DD3169E
dAk, xrefs: 6DD31EA9
o]_@, xrefs: 6DD31F85
dAk, xrefs: 6DD3163D
UUUU, xrefs: 6DD314E8
dAk, xrefs: 6DD319EE
o]_@, xrefs: 6DD31F0D
UUUU, xrefs: 6DD3201A
UUUU, xrefs: 6DD317AB

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 2333$2333$3333$3333$3333$3333$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$dAk$dAk$dAk$dAk$dAk$dAk$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@
API String ID: 0-659164211
Opcode ID: 40305abb06eb995790c3798bda0e2efbc72053f563a1c6550b478e784537c721
Instruction ID: b9a938ad18c1cc66a543901d770c7a1234679f607192944ace36a09e8f7738de
Opcode Fuzzy Hash: 40305abb06eb995790c3798bda0e2efbc72053f563a1c6550b478e784537c721
Instruction Fuzzy Hash: 6282D534718653CBCB25AB2C858062EB6E2A7D7385F66CD1AF496CB365E630CC464B43

Uniqueness

Uniqueness Score: -1.00%

Function 6DD3A853, Relevance: 31.0, Strings: 24, Instructions: 1016COMMON

Download Yara Rule

Strings

3333, xrefs: 6DD3B857
o]_@, xrefs: 6DD3AE44
UUUU, xrefs: 6DD3AFC3
UUUU, xrefs: 6DD3B501
UUUU, xrefs: 6DD3B830
UUUU, xrefs: 6DD3AF51
dAk, xrefs: 6DD3B653
dAk, xrefs: 6DD3A8E1
o]_@, xrefs: 6DD3B180
UUUU, xrefs: 6DD3B7C1
2333, xrefs: 6DD3AE61
2333, xrefs: 6DD3B6D1
dAk, xrefs: 6DD3ADE0
o]_@, xrefs: 6DD3B6B4
dAk, xrefs: 6DD3A8F7
3333, xrefs: 6DD3B8B1
3333, xrefs: 6DD3AFEA
o]_@, xrefs: 6DD3AEBC
o]_@, xrefs: 6DD3B72C
dAk, xrefs: 6DD3B167
o]_@, xrefs: 6DD3A910
UUUU, xrefs: 6DD3AC8E
dAk, xrefs: 6DD3B151
3333, xrefs: 6DD3B044

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 2333$2333$3333$3333$3333$3333$UUUU$UUUU$UUUU$UUUU$UUUU$UUUU$dAk$dAk$dAk$dAk$dAk$dAk$o]_@$o]_@$o]_@$o]_@$o]_@$o]_@
API String ID: 0-659164211
Opcode ID: 46823fffa1c5c5c8edc76b05b4b38ed427a64ed2b46f85f4513c881d88231ac7
Instruction ID: 18f9c003c7467ea7e36eb7ecfcf082f95ad28af0fc6b92bfd7d5bd9188520c11
Opcode Fuzzy Hash: 46823fffa1c5c5c8edc76b05b4b38ed427a64ed2b46f85f4513c881d88231ac7
Instruction Fuzzy Hash: 3382AF3570C752CFCB15AB18C180B2E73E2ABD6241F63DA1AF495CB369E634DD818B52

Uniqueness

Uniqueness Score: -1.00%

Function 6DD36369, Relevance: 14.2, Strings: 11, Instructions: 493COMMON

Download Yara Rule

Strings

o]_@, xrefs: 6DD368F2
3333, xrefs: 6DD36AA1
UUUU, xrefs: 6DD36A04
o]_@, xrefs: 6DD3696A
o]_@, xrefs: 6DD36374
dAk, xrefs: 6DD363D3
UUUU, xrefs: 6DD36741
UUUU, xrefs: 6DD36A73
2333, xrefs: 6DD3690F
dAk, xrefs: 6DD3688E
3333, xrefs: 6DD36B14

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 2333$3333$3333$UUUU$UUUU$UUUU$dAk$dAk$o]_@$o]_@$o]_@
API String ID: 0-3366261377
Opcode ID: 97f446ce595209b0a21095a42cc9baf41437c8edd0f7e1577344102822c49a59
Instruction ID: 7b053c6d5af239290b5afbbc998881838f5684f0f0299f4dc950ea0e12917544
Opcode Fuzzy Hash: 97f446ce595209b0a21095a42cc9baf41437c8edd0f7e1577344102822c49a59
Instruction Fuzzy Hash: 4802A474B1C612DBCF56AB18C08032E76E6ABD6260F66CD1AF895C7359F670D8424BC3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD69660, Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

wjUR, xrefs: 6DD696C1
wjUR, xrefs: 6DD699CF

Memory Dump Source

Source File: 00000004.00000002.351967517.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000004.00000002.351359273.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352603892.000000006DE16000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.352658818.000000006DE7D000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.352675104.000000006DE82000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: wjUR$wjUR
API String ID: 0-3322654707
Opcode ID: 13ad0c23db63f305aadd1b700b653e73fa08b23ccbacd40d930761e5bf63022a
Instruction ID: 74969b70a0fd9ebbf6a262c1d8e1610976edf28b2c140855cb8ee9a5d2e9a8df
Opcode Fuzzy Hash: 13ad0c23db63f305aadd1b700b653e73fa08b23ccbacd40d930761e5bf63022a
Instruction Fuzzy Hash: 2E712D36708397CBCB189F74469025EB7E35BD6301F25C61AEC589F26DCE319C498AD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1068 Parent PID: 4940 rundll32.exeCOMMON

Executed Functions

Function 04A80B52, Relevance: 3.0, APIs: 2, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00002710,0000000E,?,?,?,?,?,?,?,00000040), ref: 04A80B34
ExitProcess.KERNEL32 ref: 04A80B3C

Memory Dump Source

Source File: 00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp, Offset: 04A50000, based on PE: false

Yara matches

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: 01588b7106b3b0b0abba9fe31b99a16e3b47162eadcbaea2bccf114d821517cb
Instruction ID: 6d7177e3c4facc270c0741dc532f9eb16a6bb77417ebae09b9e06b4935339e14
Opcode Fuzzy Hash: 01588b7106b3b0b0abba9fe31b99a16e3b47162eadcbaea2bccf114d821517cb
Instruction Fuzzy Hash: 1EE026321491860BE7068660884D6657E1AE7C620CB1CC6ADD547CF5D6C834D8478780

Uniqueness

Uniqueness Score: -1.00%

Function 04B01010, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E04B01010() {
				_Unknown_base(*)()* _v8;
				void* _v12;
				struct tagMSG _v40;
				long _v44;
				struct HWND__* _v48;
				long _v52;
				void* _v56;
				void* _t39;
				void* _t44;
				int _t46;
				long _t48;

				SetTimer(0, 0, 0x25b, 0); // executed
				while(GetMessageW( &_v40, 0, 0, 0) != 0) {
					_v40.message = _v40.message + 1;
					if(_v40.message != 0x114) {
						DispatchMessageW( &_v40);
						continue;
					} else {
					}
					break;
				}
				_v12 = 0;
				_v48 = 0;
				_v52 = 0x5000;
				while(_v52 > 0x1000) {
					_v52 = _v52 - 1;
				}
				_v44 = _v52;
				while(_v44 > 0x40) {
					_v44 = _v44 - 1;
				}
				do {
					_t39 = VirtualAlloc(_v12, 0x43000, _v52, _v44); // executed
					_v8 = _t39;
					if(_v8 == 0) {
						Sleep(0x1f4);
					}
				} while (_v8 == 0);
				_v48 =  &(_v48->i);
				E04B334C0(_v48, _v8);
				_t44 = CreateThread(0, 0, _v8, 1, 0, 0); // executed
				_v56 = _t44;
				_push(0);
				_push(0x2000);
				 *_t44 = _t44 +  *_t44;
				SetTimer(0, 0, ??, ??); // executed
				while(1) {
					_push(0);
					_push(0);
					_push(0);
					_push( &_v40);
					_t46 = GetMessageW();
					if(_t46 != 0) {
						_v40.message = _v40.message + 1;
						if(_v40.message == 0x114) {
							return _t46;
						}
						_t48 = DispatchMessageW( &_v40);
						 *((intOrPtr*)(_t48 - 0x4d)) = es;
						_t46 = _t48 + 0xeb;
						asm("int3");
						continue;
					}
					return _t46;
				}
			}

0x04b01021
0x04b01027
0x04b01041
0x04b0104b
0x04b01053
0x00000000
0x00000000
0x04b0104d
0x00000000
0x04b0104b
0x04b0105b
0x04b01062
0x04b01069
0x04b01070
0x04b0107f
0x04b0107f
0x04b01087
0x04b0108a
0x04b01096
0x04b01096
0x04b0109b
0x04b010ac
0x04b010b2
0x04b010b9
0x04b010c0
0x04b010c0
0x04b010c6
0x04b010d2
0x04b010dd
0x04b010f0
0x04b010f6
0x04b010f9
0x04b010fb
0x04b010fe
0x04b01104
0x04b0110a
0x04b0110a
0x04b0110c
0x04b0110e
0x04b01113
0x04b01114
0x04b0111c
0x04b01124
0x04b0112e
0x00000000
0x00000000
0x04b01136
0x04b01138
0x04b0113b
0x04b0113d
0x00000000
0x04b0113d
0x04b01141
0x04b01141

APIs

SetTimer.USER32 ref: 04B01021
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 04B01031
DispatchMessageW.USER32 ref: 04B01053
VirtualAlloc.KERNELBASE(00000000,00043000,00001000,00000040), ref: 04B010AC
Sleep.KERNEL32(000001F4), ref: 04B010C0
CreateThread.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000), ref: 04B010F0
SetTimer.USER32 ref: 04B01104
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 04B01114
DispatchMessageW.USER32 ref: 04B01136

Strings

@, xrefs: 04B0108A

Memory Dump Source

Source File: 00000005.00000002.368401033.0000000004B00000.00000040.00000001.sdmp, Offset: 04B00000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer$AllocCreateSleepThreadVirtual
String ID: @
API String ID: 368155642-2766056989
Opcode ID: 4949580ea4c3d600b08faf02e3debb5505ae561e9fea576d4de9d05c8284e239
Instruction ID: 6b0298737d7458614530bd89644d24f96ede0e35806261571f9ed2a1ea706658
Opcode Fuzzy Hash: 4949580ea4c3d600b08faf02e3debb5505ae561e9fea576d4de9d05c8284e239
Instruction Fuzzy Hash: 4D41EA70A44218EBEB18CFB8DD49BED7B75FB48706F108159E601BB1C1D776B9009B24

Uniqueness

Uniqueness Score: -1.00%

Function 04B01151, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 254windowtimeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 04B01104
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 04B01114
DispatchMessageW.USER32 ref: 04B01136

Strings

x _n, xrefs: 04B01151

Memory Dump Source

Source File: 00000005.00000002.368401033.0000000004B00000.00000040.00000001.sdmp, Offset: 04B00000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer
String ID: x _n
API String ID: 2110285445-548084811
Opcode ID: fa2f3f90e455b51df304effd13a8cc3bcf78508e85ec3aaca0412e00e78b5d91
Instruction ID: 78ccf19592b60375569c4ea85e9a5e0695db7825fbbb2bd0fcdccbc64b56e0dd
Opcode Fuzzy Hash: fa2f3f90e455b51df304effd13a8cc3bcf78508e85ec3aaca0412e00e78b5d91
Instruction Fuzzy Hash: B7817376A042559FDB1ACF7898897D9BFB1EB82306F1481DEE041AB1D3C772A402CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04A80873, Relevance: 6.4, APIs: 4, Instructions: 435COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 04A8082F
GetLastError.KERNEL32 ref: 04A8083B

Memory Dump Source

Source File: 00000005.00000002.364114449.0000000004A50000.00000040.00000001.sdmp, Offset: 04A50000, based on PE: false

Yara matches

Similarity

API ID: CommandErrorLastLine
String ID:
API String ID: 3622356926-0
Opcode ID: 5789a7502e54ef95200c30e50943ef02d96e8280de3f19540e031d9cb63ed344
Instruction ID: 0f9870bd920667e681fd9f8865365e2bdeb305a6ddfed57d247e749a8d6c6930
Opcode Fuzzy Hash: 5789a7502e54ef95200c30e50943ef02d96e8280de3f19540e031d9cb63ed344
Instruction Fuzzy Hash: 85023874604B008FE724EF68C594B26B7E1FB48704F21482EE596DBBA1E671F849CF51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: wermgr.exe PID: 6164 Parent PID: 4012 wermgr.exeCOMMON

Executed Functions

Function 0000023602448FF0, Relevance: 6.3, APIs: 2, Strings: 1, Instructions: 1014timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 00000236024499BB
RtlAddVectoredContinueHandler.NTDLL ref: 0000023602449A69

Strings

d, xrefs: 0000023602449851

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: ContinueHandlerTimerVectored
String ID: d
API String ID: 3914890296-2564639436
Opcode ID: 18227c3602fd30338b6098bd1babf2917352dc211f9451484e7c5a1c867915ad
Instruction ID: 9a9ebca24a394e74e73dd1dfcf99fbcbdc4b8b17dadb7a09162cd08f9643b0cb
Opcode Fuzzy Hash: 18227c3602fd30338b6098bd1babf2917352dc211f9451484e7c5a1c867915ad
Instruction Fuzzy Hash: A0723131228A089FF758EF68D85E77A73D9FF94300F50852A944AC32D2DB7C9A41DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602440E30, Relevance: 5.5, APIs: 2, Instructions: 2468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96100e79d4123f31a16c1d39be629d3c5d1d7f9ac0e449a3d3f84e87a7a68fe3
Instruction ID: d6dd51e21e42c140e6de606af3520729e619f22f3a347591dd13a7b6971d3493
Opcode Fuzzy Hash: 96100e79d4123f31a16c1d39be629d3c5d1d7f9ac0e449a3d3f84e87a7a68fe3
Instruction Fuzzy Hash: 830325312246456BE79CDF28C4AE37A76D6FFC8354FA4862EF44BC65E0E73499818312

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602431140, Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 0000023602431175
AdjustTokenPrivileges.KERNELBASE ref: 00000236024311BF
FindCloseChangeNotification.KERNELBASE ref: 00000236024311CC

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: AdjustChangeCloseFindLookupNotificationPrivilegePrivilegesTokenValue
String ID:
API String ID: 3056834404-0
Opcode ID: 749abae44027d775ac53a132ff863bd9df4f0e561666286adc7e7e3ca4e87745
Instruction ID: fae1dccbf7f8d4ece57f9629e79413f3fb3147e3c7ff2a640edd727171944851
Opcode Fuzzy Hash: 749abae44027d775ac53a132ff863bd9df4f0e561666286adc7e7e3ca4e87745
Instruction Fuzzy Hash: 94115E316187084FE7A4DB29EC4DB6BBBE5FBC8351F51492AB44AC3260DA39C945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243A940, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI ref: 000002360243A9A6

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: 0c9baacfc9ebfc635b1340ae027b92590ec9824562b69bfaa586c6d2372c17ca
Instruction ID: 4a22d2955a98c008ac82c9d1dd551d11f88a2d1b4cf4405d74049143ac855397
Opcode Fuzzy Hash: 0c9baacfc9ebfc635b1340ae027b92590ec9824562b69bfaa586c6d2372c17ca
Instruction Fuzzy Hash: 6A41D331228A285BF75CAF58D49EBBAB7D9FF84310F41816DE486C3282CB3CCA058651

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243B040, Relevance: 1.5, APIs: 1, Instructions: 35nativeCOMMON

Download Yara Rule

APIs

NtDelayExecution.NTDLL(?,?,?,?,?,?,?,F92DC8D4,000006FB,0000023602454E2A), ref: 000002360243B075

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 07705df569bbb2a3a9af4fdd73cdb681984a2ca1baf6f2d63bc4b367156a53e0
Instruction ID: 2b507751e712f47eefb30c88784c0f1ca5dbe50537f40fbcc0e311d740e0615b
Opcode Fuzzy Hash: 07705df569bbb2a3a9af4fdd73cdb681984a2ca1baf6f2d63bc4b367156a53e0
Instruction Fuzzy Hash: CBE0D831A1491C46D25C523C9C0E37A71E4FB8D324F104317E419F31E0D72C8E8246D1

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602454910, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00000236024549B3

Strings

\, xrefs: 0000023602454970
:, xrefs: 0000023602454969
C, xrefs: 0000023602454959

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 169f0c68ffbc20f060a5f81cc637079ef80fc92d98ba99ef8d4017ca280ea384
Instruction ID: 6db74f84aba455f849d4637f267973c9305f06091bdb700858e256b67f129f77
Opcode Fuzzy Hash: 169f0c68ffbc20f060a5f81cc637079ef80fc92d98ba99ef8d4017ca280ea384
Instruction Fuzzy Hash: 5C417120218B945AE74D9B68D41E7BFB6D5FF89740F10551DF08AC7282CB68860687A7

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602439BF0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

, xrefs: 0000023602439DB0

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5a9f11097b4b0faacf756809c4ae2afc850ce30516d4637924147153b8457eab
Instruction ID: 1b3fdfe85add90317c9e0d1d60c01b8935456e3e6e1cb27a124c7c4e151f4ac9
Opcode Fuzzy Hash: 5a9f11097b4b0faacf756809c4ae2afc850ce30516d4637924147153b8457eab
Instruction Fuzzy Hash: D5513831228A045BE71CAB29E84E3BB72DAFFC5310F45852DE446C72D2DFBD99468681

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243F350, Relevance: 3.3, APIs: 2, Instructions: 261threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 000002360243F57D
SleepEx.KERNEL32 ref: 000002360243F58C

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 1e88f74eeeba97a0e82f472f6d57454e3a83ba4e2a26d2b2e74b4d2555db0ecc
Instruction ID: e722b680ce41b2829a77d89a501439bd179443751a22219d51be6e662a885a89
Opcode Fuzzy Hash: 1e88f74eeeba97a0e82f472f6d57454e3a83ba4e2a26d2b2e74b4d2555db0ecc
Instruction Fuzzy Hash: 9981F07161CB489FDBA4DF18D489BAAB7E4FB98310F50891EE08DC3261D734E9458B52

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602437D80, Relevance: 1.6, APIs: 1, Instructions: 150synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 0000023602437EE1

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 64667c22d55667bb93d456f5408bd23d0badbb120ba62ce75d5c6b7e270f003c
Instruction ID: 7e963a8449f0d0ca64d0100f46403f437e050447ea168f61df0429fdcc45e649
Opcode Fuzzy Hash: 64667c22d55667bb93d456f5408bd23d0badbb120ba62ce75d5c6b7e270f003c
Instruction Fuzzy Hash: 8B417530328A049BE798EB18D45E7BEB7D6FFD8354F40452DE08AC3291DB38D9418792

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602454D80, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(000000E4,?,?,?,?,?,?,?,0000023602431023), ref: 0000023602454DC5

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a4c4c420da95a5823c2dc99479cda70e1fdfd1729f60a087d0d2025014f9f432
Instruction ID: 591d7b0762dfb1f991097eaae3fa57e53be2f58b6d0e88bed8bc7782b4ad7072
Opcode Fuzzy Hash: a4c4c420da95a5823c2dc99479cda70e1fdfd1729f60a087d0d2025014f9f432
Instruction Fuzzy Hash: 8A2137313299161BFB5C9B2DAC5E7BA36C6EBD8321F14406ED489C3296CE2CDC418790

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243D940, Relevance: 1.6, APIs: 1, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 000002360243D990

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: a802549aca57c51acf0545526bc9ed935d2a2d1d0adbb178d5524f511700423f
Instruction ID: 02d7e8bedd408dc0a93838d864e5e687e54071c87af9c1b614efb979b6172f7e
Opcode Fuzzy Hash: a802549aca57c51acf0545526bc9ed935d2a2d1d0adbb178d5524f511700423f
Instruction Fuzzy Hash: 6321D130628704EFD798DF19C4CDB7AB3E6FF98311F15855AE04AC729AD7289A40C752

Uniqueness

Uniqueness Score: -1.00%

Function 00000236023D0000, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00000236023D0027

Memory Dump Source

Source File: 00000006.00000002.637360628.00000236023D0000.00000040.00000001.sdmp, Offset: 00000236023D0000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction ID: 514364b43ea4cb4e75b54ab01e38b0eafdba1ff95b47652a099c5dc543a6aa41
Opcode Fuzzy Hash: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction Fuzzy Hash: 78D05E20514909BFD6BCE77DD84DB3A23E8EF88710F95824A901DC3191C914EE008791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00000236024459A0, Relevance: 11.7, Strings: 9, Instructions: 486COMMON

Download Yara Rule

Strings

, xrefs: 0000023602445C4B
FGKL, xrefs: 0000023602445A17
RSlU, xrefs: 0000023602445A08
qrst, xrefs: 00000236024459DB
HJIA, xrefs: 0000023602445A26
Zfbc, xrefs: 00000236024459F9
MEDy, xrefs: 00000236024459BD
hi5k, xrefs: 00000236024459EA
89o1, xrefs: 00000236024459CC

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID: $89o1$FGKL$HJIA$MEDy$RSlU$Zfbc$hi5k$qrst
API String ID: 0-282953138
Opcode ID: 411710d8535fdb506557e7645596e6320d36a7b50015a53e54314037d3163ace
Instruction ID: 13c101d2718751dcc6fe1e3e40d01606c8f3ca1fb30562321b1eb2c72b40d05a
Opcode Fuzzy Hash: 411710d8535fdb506557e7645596e6320d36a7b50015a53e54314037d3163ace
Instruction Fuzzy Hash: C4E1167125CB884FE768EF28D44E7EA7BD0FFA9314F44496ED0C9C7292C6288945C712

Uniqueness

Uniqueness Score: -1.00%

Function 000002360244EA50, Relevance: 6.5, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

yes, xrefs: 000002360244EAF7
yes, xrefs: 000002360244EC67
yes, xrefs: 000002360244EC8C
yes, xrefs: 000002360244EC2E
yes, xrefs: 000002360244ECF3

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID: yes$yes$yes$yes$yes
API String ID: 0-3543357270
Opcode ID: 9e519e799a43bbdafa16b07c0322910c8a6b9466a9f9437eefdca29d675e5400
Instruction ID: c63f4f7659ca74c1e0454a519a85563bedd9946ef7ae5d428c9d46d2499632b5
Opcode Fuzzy Hash: 9e519e799a43bbdafa16b07c0322910c8a6b9466a9f9437eefdca29d675e5400
Instruction Fuzzy Hash: 9C71A27072490A6AFBBC9E28C48F735E2D9FF54300F14C859D446C62C6DB68EF408676

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602439380, Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

], xrefs: 000002360243947B
[, xrefs: 0000023602439460

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID: [$]
API String ID: 0-2073744556
Opcode ID: 59717c2fe713dc1c6ce3dbed4cf3178b8d15287320e5b7ad9f5474d6347c5c89
Instruction ID: 329755be3859a83cd0dbe72c294b10b562c1463bc14cca924f0e6e91dca3111e
Opcode Fuzzy Hash: 59717c2fe713dc1c6ce3dbed4cf3178b8d15287320e5b7ad9f5474d6347c5c89
Instruction Fuzzy Hash: EB71FB32728A045BE76CAA29C44E776B2DAFFC8314F50852DD486C73D2EF78DE028651

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243BB70, Relevance: 2.7, Strings: 1, Instructions: 1430COMMON

Download Yara Rule

Strings

D, xrefs: 000002360243C956

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 240262bc76f366688e2334fadc596f47caa515c9b0d1b8b9778a82043d0795b6
Instruction ID: 1ef9241002a323c97c55e85a1a358ab7606c848eca2dee5a313717020ecd1ee8
Opcode Fuzzy Hash: 240262bc76f366688e2334fadc596f47caa515c9b0d1b8b9778a82043d0795b6
Instruction Fuzzy Hash: C092D331234A456BE79CDB28C4AE77972D6FF88314FA4962FF843C62D1EB34DA418611

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024438C0, Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

/, xrefs: 000002360244390E

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: c5f2d7437c2c828f2ba20fdad4db8942bd08e03c36899414253f075f365525c4
Instruction ID: 08e8ad2b57aafc0b8114e3cf11ad3916fee1c4746f060fde052b7adec9264668
Opcode Fuzzy Hash: c5f2d7437c2c828f2ba20fdad4db8942bd08e03c36899414253f075f365525c4
Instruction Fuzzy Hash: B7912371924A185FE768DF0CD08DB65B7E6FF98310F258299E44AD32A2DB34DE4187A0

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243E8E0, Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 3e04ea05c6fea09fd511dad7c06b7be5244fc06d3a7c90c1b594442d69a49905
Instruction ID: 216c81dd9196142e4f6ad0c64c1f01bb4c3d298fb04eda17149f4e8bc7ca2960
Opcode Fuzzy Hash: 3e04ea05c6fea09fd511dad7c06b7be5244fc06d3a7c90c1b594442d69a49905
Instruction Fuzzy Hash: C3E1E630624A198BEB68AF68C49E7BB72D4FF94340F548519E882C72D1EB7CCA45C791

Uniqueness

Uniqueness Score: -1.00%

Function 000002360244DCE0, Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c9819856d02b8f663fb87950b422025bc4f59d6e43d1adb54b8df84980c484
Instruction ID: 37912bba3121c12249c594e92547964ea3e005e0a6551001c8312a33c2ba2445
Opcode Fuzzy Hash: 52c9819856d02b8f663fb87950b422025bc4f59d6e43d1adb54b8df84980c484
Instruction Fuzzy Hash: D8C1737072CA099BE65CEF18D48AB3A77D5FF98340F40852DE98AC32D2DF38E9418655

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024408F0, Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10420dba0253daf2fb27d028f1edcb719e37194c086bc8e71a97660557f5a194
Instruction ID: 191361bd6a35e1eeafddb42562bb379c13ceaa5c81a73dc5b3498be171090504
Opcode Fuzzy Hash: 10420dba0253daf2fb27d028f1edcb719e37194c086bc8e71a97660557f5a194
Instruction Fuzzy Hash: 7FA1653021CB089FE798EF18D489B6AB7E5FF99304F50555DE18AD32A1CB35D941CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602440060, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f923e6332539378fc1986f1f11aafcd0df537e83c446f9f03b36059265537b2
Instruction ID: ffddb4510d9581c889f350a8ba89a0f373662427c684f36b3f91ec3fa6ba2681
Opcode Fuzzy Hash: 5f923e6332539378fc1986f1f11aafcd0df537e83c446f9f03b36059265537b2
Instruction Fuzzy Hash: 4671E631724A196BE75DAF28D84E7B9B2DAFF84740F40906CE846C32D3DF29DE1146A1

Uniqueness

Uniqueness Score: -1.00%

Function 000002360244B5B0, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec2aee3f88e0b5a8a60aeea10dc49edd2434e589a76c65061822e3677f6a078
Instruction ID: 8a33382c8256337ca5d6f107812c0ffb951c9db7e31fd4bb73a291e1e60d25e4
Opcode Fuzzy Hash: 5ec2aee3f88e0b5a8a60aeea10dc49edd2434e589a76c65061822e3677f6a078
Instruction Fuzzy Hash: 63513E217249195FFB9CEF29D89E779B2DAFF88740F408069940AC3293DF29DE018661

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243AC30, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358569824b658d4df52f9b6b222c99b94062db61ae7a8fed6208ccd25163be06
Instruction ID: b552200656a8e564c4837c08f5b517f320bf5b271c0bc3991802365e83af586c
Opcode Fuzzy Hash: 358569824b658d4df52f9b6b222c99b94062db61ae7a8fed6208ccd25163be06
Instruction Fuzzy Hash: 6F51FC2176CA185BF66C6A28E84F3BA72DBFF85311F548519D08AC31D2DF2CCE4242D6

Uniqueness

Uniqueness Score: -1.00%

Function 000002360245423F, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0c1ce5bc98be6fc62b2ba98c43abb7c394d2267777dc670c3d9c7c5ed209af
Instruction ID: e2fe20ca81aa05d51f520b402526ffc4210325fc2e8b198893dc91ff530d6b9d
Opcode Fuzzy Hash: 7c0c1ce5bc98be6fc62b2ba98c43abb7c394d2267777dc670c3d9c7c5ed209af
Instruction Fuzzy Hash: AF413C31768F1C4FEB0C9E6CE88E3B973C5EB96311F10462ED4C6D71E2C665958A4291

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024542EF, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194a5e4d0c404c95f9f987e8aab410d52246090afe29dc72f6bfe6e9f71e8553
Instruction ID: 30615601bdb00b47d8777ff827dbc6b5702febf8340d53994313be51ee9a6518
Opcode Fuzzy Hash: 194a5e4d0c404c95f9f987e8aab410d52246090afe29dc72f6bfe6e9f71e8553
Instruction Fuzzy Hash: 21312535768E280FEB0CAE6CE88E3B933C5EB96311F10553ED4C7D72E3C956998A4191

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024542AF, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c2062ff2cc060585b116abed39cc7bbbf1cdec9607825c9587755ddf81de01
Instruction ID: ac0b277e12f91fa9f3a149e757203ad70423ddf2029a0e59c2218bce45169d59
Opcode Fuzzy Hash: 87c2062ff2cc060585b116abed39cc7bbbf1cdec9607825c9587755ddf81de01
Instruction Fuzzy Hash: DC31253576CA280FEB0CAE6CA88E3B973C5EB96310F10553ED4C7C72A3C956998A4181

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602454355, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1710ff75d24b8c7e2f687d62a66bbbc39a9e9bdc6e5192202777fa5c1feee37a
Instruction ID: bcb5d93583fac23a2bb25e0b85c7ebd9d23bb6a0422670f7ca4248afe18b4664
Opcode Fuzzy Hash: 1710ff75d24b8c7e2f687d62a66bbbc39a9e9bdc6e5192202777fa5c1feee37a
Instruction Fuzzy Hash: 07314635768E2C0FDB0CAD7CA88E2B973C5EB96311F10953ED4C7D72A3C956998A4181

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024542CD, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b81900b66ec0fc3934870c90db4d4419571923f6d5f81b693cc780b4ec0419
Instruction ID: 2fd3def9be40fa1336801fd774e70e1dcfaa4c9594d1bf65fea738b0b23329f2
Opcode Fuzzy Hash: 20b81900b66ec0fc3934870c90db4d4419571923f6d5f81b693cc780b4ec0419
Instruction Fuzzy Hash: B9312631768E280FEB0CAE6CE88E3B933C5EB96310F10553ED4C7D72A3C956998A4191

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602454336, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d26c09354d022c8ff59ed0d0f5f5949bc7cdb55f4f2c8ba55122333bf9f50af
Instruction ID: 6c8a6a749dfc6d95119a0653494ff3f13614a4f11998c0030f484cd2fe5d3d59
Opcode Fuzzy Hash: 4d26c09354d022c8ff59ed0d0f5f5949bc7cdb55f4f2c8ba55122333bf9f50af
Instruction Fuzzy Hash: F8312631768E180FEB0CAE6CE88E3B933C5EB96311F10552ED4C7D72A3C956998A4191

Uniqueness

Uniqueness Score: -1.00%

Function 000002360245431B, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e78aa0ddf7ce601d538710ea86c0565e12748744ff7c9a7c0a1b1166bae8fba
Instruction ID: cff4b6f0ab9320dea6d16ee181d8b071cb88cd66146510348a1dcc50b2ccaea6
Opcode Fuzzy Hash: 0e78aa0ddf7ce601d538710ea86c0565e12748744ff7c9a7c0a1b1166bae8fba
Instruction Fuzzy Hash: A1313731768E2C0FEB0C6D7CE88E3B933C5EBA6311F10563ED4C6D71A3DA56998A4191

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602437890, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13dcc6ff968d3354e8810a6010a3a9f89f962bc6faa166ecce9a7d9a4eda3cb
Instruction ID: 804974be4d2f037bc4878a874ae1d154a98ee0ee7a6301cc4920c3b26b6f6ae7
Opcode Fuzzy Hash: c13dcc6ff968d3354e8810a6010a3a9f89f962bc6faa166ecce9a7d9a4eda3cb
Instruction Fuzzy Hash: 4541F671628A282BE75CAB18C45E775F2D5FF89320F41825DE48AD32D2CB299E0186D1

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602452EE0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ca5cf7dbb2d22abc193fb064f9f4d0559e8a73e06e2d189a2f11448a73b26a
Instruction ID: 2c086869bcb74b8c72a1e48d728c9ce26978dfae00a85a44bc2e125bb758439f
Opcode Fuzzy Hash: b9ca5cf7dbb2d22abc193fb064f9f4d0559e8a73e06e2d189a2f11448a73b26a
Instruction Fuzzy Hash: F421FB3261CA241BE758EB28FC4E7BA72D5FBC4320F00462ED847D3195DB69DA0247D1

Uniqueness

Uniqueness Score: -1.00%

Function 000002360244F460, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e8e890006c3a62e28b7e08568ee607895b8cc4543687454160c284bed58313
Instruction ID: f8c45af2a7bf995d7e173bc87c8faf059a89afbc301da0324455effc0f4e92be
Opcode Fuzzy Hash: 19e8e890006c3a62e28b7e08568ee607895b8cc4543687454160c284bed58313
Instruction Fuzzy Hash: AB31F2725245096AE73C9E08D44E778B3D9FF54310F678119C486C3A83DB79AE89C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602436B90, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1726cf4867e6ea43003eb798981ed6b8f50ce894572de999c2f633f06d98a958
Instruction ID: 4e7ec9281d5621c7c4e799f5981483454fa8e3f6e91226106e0afca9e8884ea1
Opcode Fuzzy Hash: 1726cf4867e6ea43003eb798981ed6b8f50ce894572de999c2f633f06d98a958
Instruction Fuzzy Hash: 4F119C2013598646E31E4A08D89D3B4FBDCFB63305F5853ADC8C3CB1A3E55AA687856A

Uniqueness

Uniqueness Score: -1.00%

Function 000002360243E570, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d8bdc47c0a03523d7cb7ce4cbc93815f8e6e5f6183d6a50037d953edfc4373
Instruction ID: 8fe308faa08d19eb88c066607d39792fa9b87850d20ce91e7321d45ec8949c92
Opcode Fuzzy Hash: 39d8bdc47c0a03523d7cb7ce4cbc93815f8e6e5f6183d6a50037d953edfc4373
Instruction Fuzzy Hash: AE012621726E150AE76D0C3C9D4D3B275C3FFEA622F58DB3A9042C32E9D92588470054

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602452CB0, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60749ab3a1a0ef2928ddb63c7c725e70a8db3a0db37ef682c7175f703abc233c
Instruction ID: 3f0c6966b9c8834f7fdf2c4a005019015e856bd8b2e37b168da8624510d19858
Opcode Fuzzy Hash: 60749ab3a1a0ef2928ddb63c7c725e70a8db3a0db37ef682c7175f703abc233c
Instruction Fuzzy Hash: A1112931218A2D2AF6BC991DE80E776B2C9FF84660F11521FDC8AC3243EF54D84141A0

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024484D0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6288d30e77d39ec9480cffbdb04dd696c4803a374fbc28f9d0f3d664f75f12f7
Instruction ID: 2dca3d41443873d3a522006af45864928fbe7cc9b93ebf8e4e854f0d98ee0a56
Opcode Fuzzy Hash: 6288d30e77d39ec9480cffbdb04dd696c4803a374fbc28f9d0f3d664f75f12f7
Instruction Fuzzy Hash: F111B6217608285BF69DBB18E85E379A2DBFFC8710F855454D409E32A2DF2CAD0183A1

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602434670, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18792c3ab75a70aaa82c0d33e1d8ad1676b8087ecad213e2bde7c8afdf30a91
Instruction ID: 9df7afcd9e118969b43ae047f319fa0f2571acafda30a9e6c24f749ca86a504c
Opcode Fuzzy Hash: a18792c3ab75a70aaa82c0d33e1d8ad1676b8087ecad213e2bde7c8afdf30a91
Instruction Fuzzy Hash: 8001F72BBB9A9602B72C0C6AE8952B362CEF79675BF19B03D94C7D3082D95D8C030064

Uniqueness

Uniqueness Score: -1.00%

Function 00000236024354F0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c65da9999f813d349450ebd04834870ce2b01326243675b9e30b666ee68e2db
Instruction ID: 8b09c0f50783235d4c447af811a62092cfd902d524ff40fe635a7aad8f8fd67c
Opcode Fuzzy Hash: 8c65da9999f813d349450ebd04834870ce2b01326243675b9e30b666ee68e2db
Instruction Fuzzy Hash: 8E016D2123AA8105E31E062C806E338F7C6FB6B302FE853EDC4C3CA5E7D9452582C191

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602446510, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a641310da9baa0e243b12c7863b620dd3cb2b2b76492c23d04c76831b65a111
Instruction ID: 2bb476bd4e2e05ba2b37e464a3c7baf7b8833e513638a96461f94b8a2b0759ef
Opcode Fuzzy Hash: 7a641310da9baa0e243b12c7863b620dd3cb2b2b76492c23d04c76831b65a111
Instruction Fuzzy Hash: 31014C336585240BE33C2C7DBC5E1B5798AEBCA664F2B952DD49AC324AE92A89560090

Uniqueness

Uniqueness Score: -1.00%

Function 0000023602450B70, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02403acfcab441e65a35524e80cc77f1fdbf7058216b42610e7bbb9d32d2c27
Instruction ID: 9184f6c9801957bf2721a78c356d3498e6f8b68eaf7a80c4e0f7e95fee90d035
Opcode Fuzzy Hash: e02403acfcab441e65a35524e80cc77f1fdbf7058216b42610e7bbb9d32d2c27
Instruction Fuzzy Hash: ADD05E31824D084EDB51EF18C08CFB0F3E4EB1B345FA022DAC009CB012E626EC82C740

Uniqueness

Uniqueness Score: -1.00%

Function 000002360244E610, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.637428586.0000023602430000.00000040.00000001.sdmp, Offset: 0000023602430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560e6a23cc83d760b71f7b18a3e747a9364d9c171f49b35192518ae87a33829f
Instruction ID: b8fcde7120d1895dd6a50f3988219af66d19bb984d7a776340855f9b2d17eaca
Opcode Fuzzy Hash: 560e6a23cc83d760b71f7b18a3e747a9364d9c171f49b35192518ae87a33829f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wermgr.exe PID: 6176 Parent PID: 1068 wermgr.exeCOMMON

Executed Functions

Function 0000023538D38FF0, Relevance: 6.3, APIs: 2, Strings: 1, Instructions: 1014timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 0000023538D399BB
RtlAddVectoredContinueHandler.NTDLL ref: 0000023538D39A69

Strings

d, xrefs: 0000023538D39851

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: ContinueHandlerTimerVectored
String ID: d
API String ID: 3914890296-2564639436
Opcode ID: 1beb9ee5a283899b370bb658c563346bd27b02a3a505371d405b1abf51667464
Instruction ID: 8fbb8a3f1cca9340aac4795b06fbd80a596cbd83f9095bd1c0f1d18265ad38ea
Opcode Fuzzy Hash: 1beb9ee5a283899b370bb658c563346bd27b02a3a505371d405b1abf51667464
Instruction Fuzzy Hash: 50729332218E188FF798EBA8D85977973D1F785380F520969940EC32E1DFBC9A49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D30E30, Relevance: 5.5, APIs: 2, Instructions: 2468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae1737494b5d2846e1b2940d50ad3868b35a25309290efc1491b76a35d057aa
Instruction ID: 70e191cfb180674974b660010ab14cf9cc7729909b95a8c70dea7b3563f17ee3
Opcode Fuzzy Hash: eae1737494b5d2846e1b2940d50ad3868b35a25309290efc1491b76a35d057aa
Instruction Fuzzy Hash: 43033A32204A455BD79CDB7884A937E77D2FBC8391FA50A6EF44BC61E0E778D9858302

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D21140, Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 0000023538D21175
AdjustTokenPrivileges.KERNELBASE ref: 0000023538D211BF
FindCloseChangeNotification.KERNELBASE ref: 0000023538D211CC

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: AdjustChangeCloseFindLookupNotificationPrivilegePrivilegesTokenValue
String ID:
API String ID: 3056834404-0
Opcode ID: 749abae44027d775ac53a132ff863bd9df4f0e561666286adc7e7e3ca4e87745
Instruction ID: 11582e843ddc67a9536e35e3600c2877c02f4915297ab313a2cd5f8968c8a3b5
Opcode Fuzzy Hash: 749abae44027d775ac53a132ff863bd9df4f0e561666286adc7e7e3ca4e87745
Instruction Fuzzy Hash: C3116131618B084FE7A4DB29EC4CB5BBBE5FBC8351F51492EB44AC3260DA39C945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D2A940, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI ref: 0000023538D2A9A6

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: cc3625f9793a903280158f7bbb12432c536a2c91bc8f911b1241b026e7ec418c
Instruction ID: be9d54c34c5189b4dfa79ffb1b33d39a66c7eb9c3769e442b61bd7f3660d2d77
Opcode Fuzzy Hash: cc3625f9793a903280158f7bbb12432c536a2c91bc8f911b1241b026e7ec418c
Instruction Fuzzy Hash: 4841C732218E254FF75CAB599499BBAB3D1FBC4380F5649EDE44AC7281CE3CDA098641

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D2B040, Relevance: 1.5, APIs: 1, Instructions: 35nativeCOMMON

Download Yara Rule

APIs

NtDelayExecution.NTDLL(?,?,?,?,?,?,?,F92DC8D4,000006FB,0000023538D44E2A), ref: 0000023538D2B075

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 07705df569bbb2a3a9af4fdd73cdb681984a2ca1baf6f2d63bc4b367156a53e0
Instruction ID: 650fbdb03e3f3a111ab173a8243995ffa23c326967992d918eb06702347ed55c
Opcode Fuzzy Hash: 07705df569bbb2a3a9af4fdd73cdb681984a2ca1baf6f2d63bc4b367156a53e0
Instruction Fuzzy Hash: 69E0D832604D2C8AD25D523C5C0DB7A71D0E78E330F110757E45DF31E0D65C8E8642C1

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D44910, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 0000023538D449B3

Strings

\, xrefs: 0000023538D44970
C, xrefs: 0000023538D44959
:, xrefs: 0000023538D44969

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 169f0c68ffbc20f060a5f81cc637079ef80fc92d98ba99ef8d4017ca280ea384
Instruction ID: 6652d5e71160d4bc06e8c68243d350fd02bb877e5becc5fdca2e7e2855e8a33a
Opcode Fuzzy Hash: 169f0c68ffbc20f060a5f81cc637079ef80fc92d98ba99ef8d4017ca280ea384
Instruction Fuzzy Hash: 6341842121CFA44AE74DA76894197BFF6D1FFC9740F10195DE08AC7386CB6C860A8397

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D29BF0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

, xrefs: 0000023538D29DB0

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5a9f11097b4b0faacf756809c4ae2afc850ce30516d4637924147153b8457eab
Instruction ID: 13f161301b20f280937f58180102f870097fdc9b3e720de7797e9875d3a88140
Opcode Fuzzy Hash: 5a9f11097b4b0faacf756809c4ae2afc850ce30516d4637924147153b8457eab
Instruction Fuzzy Hash: 00516B32218E144BE31C6B29E84D7FB72D2EBC5350F464A6DE44AC73D2DF7D894A8681

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D2F350, Relevance: 3.3, APIs: 2, Instructions: 261threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0000023538D2F57D
SleepEx.KERNEL32 ref: 0000023538D2F58C

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 1e88f74eeeba97a0e82f472f6d57454e3a83ba4e2a26d2b2e74b4d2555db0ecc
Instruction ID: df170be55cd5aaefbf0ae3cf23926c2ebe08053feabcf802e95b8c359c9ce3ad
Opcode Fuzzy Hash: 1e88f74eeeba97a0e82f472f6d57454e3a83ba4e2a26d2b2e74b4d2555db0ecc
Instruction Fuzzy Hash: A7812F7160CB588FDBA4EF1CD485BAAB7E0FB98350F50491EE08DC3265D734E9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D27D80, Relevance: 1.6, APIs: 1, Instructions: 150synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 0000023538D27EE1

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 64667c22d55667bb93d456f5408bd23d0badbb120ba62ce75d5c6b7e270f003c
Instruction ID: c1ccdde527cfac0d4b13b6741b2de8305ffd68ae34ca1c1cb65db3f0f7e07557
Opcode Fuzzy Hash: 64667c22d55667bb93d456f5408bd23d0badbb120ba62ce75d5c6b7e270f003c
Instruction Fuzzy Hash: E7418431318E188BE798EB1994587BEB7E2FBD8340F45096DE04AC3291DE7CDA458782

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D44D80, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(000000E4,?,?,?,?,00000062,00000062,?,0000023538D21023), ref: 0000023538D44DC5

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a4c4c420da95a5823c2dc99479cda70e1fdfd1729f60a087d0d2025014f9f432
Instruction ID: 852b1041482647ff9cf66fce0df6ca66408cc840220ef232d89786facb1045e7
Opcode Fuzzy Hash: a4c4c420da95a5823c2dc99479cda70e1fdfd1729f60a087d0d2025014f9f432
Instruction Fuzzy Hash: 9C21223221AD260BEB6C972DAC5D77636C3E3D8321F1500AAD449C3395CE2CD9528680

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538D2D940, Relevance: 1.6, APIs: 1, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000023538D2D990

Memory Dump Source

Source File: 00000007.00000002.636572541.0000023538D20000.00000040.00000001.sdmp, Offset: 0000023538D20000, based on PE: false

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: a802549aca57c51acf0545526bc9ed935d2a2d1d0adbb178d5524f511700423f
Instruction ID: 930a4c4e2ab882a2951452b49c333d01b8aadf2ac88aec38e6b597af21d59520
Opcode Fuzzy Hash: a802549aca57c51acf0545526bc9ed935d2a2d1d0adbb178d5524f511700423f
Instruction Fuzzy Hash: A121D431118B188FD798DF09C4C8B7AB3E1FB98351F16499AF04EC725AD7289A48C752

Uniqueness

Uniqueness Score: -1.00%

Function 0000023538CC0000, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 0000023538CC0027

Memory Dump Source

Source File: 00000007.00000002.636557058.0000023538CC0000.00000040.00000001.sdmp, Offset: 0000023538CC0000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction ID: 0ea55151a3561b687fe355cedfcbbd0504407e7265150dece8daa4be640e93b8
Opcode Fuzzy Hash: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction Fuzzy Hash: 39D0A730504D1D9FD6B8E76DD848B2622F4DF88350F16028A901DC71D1C918ED058791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6328 Parent PID: 2272 rundll32.exeCOMMON

Executed Functions

Function 034E0A85, Relevance: 3.1, APIs: 2, Instructions: 56sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00002710,0000000E,?,?,?,?,?,?,?,?), ref: 034E0B34
ExitProcess.KERNEL32 ref: 034E0B3C

Memory Dump Source

Source File: 0000000C.00000002.330091629.00000000034B0000.00000040.00000001.sdmp, Offset: 034B0000, based on PE: false

Yara matches

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: 0ebf029bf56ac8916c910a37dc7e2e05aa39e7992f0bb4f06275a8d85f743854
Instruction ID: 0aab04969921a2c26016323e8a2c559f23a887ab6f98f28142abdadeb4aea5c2
Opcode Fuzzy Hash: 0ebf029bf56ac8916c910a37dc7e2e05aa39e7992f0bb4f06275a8d85f743854
Instruction Fuzzy Hash: F321A279600A009FD354DF28C594B52BBE5FF49708F14899DE65A8FBA1C771F901CB40

Uniqueness

Uniqueness Score: -1.00%

Function 034E0B52, Relevance: 3.0, APIs: 2, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00002710,0000000E,?,?,?,?,?,?,?,?), ref: 034E0B34
ExitProcess.KERNEL32 ref: 034E0B3C

Memory Dump Source

Source File: 0000000C.00000002.330091629.00000000034B0000.00000040.00000001.sdmp, Offset: 034B0000, based on PE: false

Yara matches

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: c79ad27236d6671481a437246bbe77fc43c48373d95ba209dd422da546846df8
Instruction ID: 01a2e3a5055572295fb59cbe9e76d271388264c8992abe5b190ce2e8e4c87672
Opcode Fuzzy Hash: c79ad27236d6671481a437246bbe77fc43c48373d95ba209dd422da546846df8
Instruction Fuzzy Hash: E5E026211141864FD706E6608859596AE6EABC6209B0CCA6ED147CF5DBC960C5478390

Uniqueness

Uniqueness Score: -1.00%

Function 04FA1010, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E04FA1010() {
				_Unknown_base(*)()* _v8;
				void* _v12;
				struct tagMSG _v40;
				long _v44;
				struct HWND__* _v48;
				long _v52;
				void* _v56;
				void* _t39;
				void* _t44;
				int _t46;
				long _t48;

				SetTimer(0, 0, 0x25b, 0); // executed
				while(GetMessageW( &_v40, 0, 0, 0) != 0) {
					_v40.message = _v40.message + 1;
					if(_v40.message != 0x114) {
						DispatchMessageW( &_v40);
						continue;
					} else {
					}
					break;
				}
				_v12 = 0;
				_v48 = 0;
				_v52 = 0x5000;
				while(_v52 > 0x1000) {
					_v52 = _v52 - 1;
				}
				_v44 = _v52;
				while(_v44 > 0x40) {
					_v44 = _v44 - 1;
				}
				do {
					_t39 = VirtualAlloc(_v12, 0x43000, _v52, _v44); // executed
					_v8 = _t39;
					if(_v8 == 0) {
						Sleep(0x1f4);
					}
				} while (_v8 == 0);
				_v48 =  &(_v48->i);
				E04FD34C0(_v48, _v8);
				_t44 = CreateThread(0, 0, _v8, 1, 0, 0); // executed
				_v56 = _t44;
				_push(0);
				_push(0x2000);
				 *_t44 = _t44 +  *_t44;
				SetTimer(0, 0, ??, ??); // executed
				while(1) {
					_push(0);
					_push(0);
					_push(0);
					_push( &_v40);
					_t46 = GetMessageW();
					if(_t46 != 0) {
						_v40.message = _v40.message + 1;
						if(_v40.message == 0x114) {
							return _t46;
						}
						_t48 = DispatchMessageW( &_v40);
						 *((intOrPtr*)(_t48 - 3)) = es;
						_t46 = _t48 + 0xeb;
						asm("int3");
						continue;
					}
					return _t46;
				}
			}

0x04fa1021
0x04fa1027
0x04fa1041
0x04fa104b
0x04fa1053
0x00000000
0x00000000
0x04fa104d
0x00000000
0x04fa104b
0x04fa105b
0x04fa1062
0x04fa1069
0x04fa1070
0x04fa107f
0x04fa107f
0x04fa1087
0x04fa108a
0x04fa1096
0x04fa1096
0x04fa109b
0x04fa10ac
0x04fa10b2
0x04fa10b9
0x04fa10c0
0x04fa10c0
0x04fa10c6
0x04fa10d2
0x04fa10dd
0x04fa10f0
0x04fa10f6
0x04fa10f9
0x04fa10fb
0x04fa10fe
0x04fa1104
0x04fa110a
0x04fa110a
0x04fa110c
0x04fa110e
0x04fa1113
0x04fa1114
0x04fa111c
0x04fa1124
0x04fa112e
0x00000000
0x00000000
0x04fa1136
0x04fa1138
0x04fa113b
0x04fa113d
0x00000000
0x04fa113d
0x04fa1141
0x04fa1141

APIs

SetTimer.USER32 ref: 04FA1021
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 04FA1031
DispatchMessageW.USER32 ref: 04FA1053
VirtualAlloc.KERNELBASE(00000000,00043000,00001000,00000040), ref: 04FA10AC
Sleep.KERNEL32(000001F4), ref: 04FA10C0
CreateThread.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000), ref: 04FA10F0
SetTimer.USER32 ref: 04FA1104
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 04FA1114
DispatchMessageW.USER32 ref: 04FA1136

Strings

@, xrefs: 04FA108A

Memory Dump Source

Source File: 0000000C.00000002.358957054.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer$AllocCreateSleepThreadVirtual
String ID: @
API String ID: 368155642-2766056989
Opcode ID: fece503bb0dcbedb4a5512cd4b4061a00e61f62ca85ca40b4852577ecf14b4ce
Instruction ID: fe5bd082a1439c786541444babc70855ba7f982899798d60f84c1626083ad33b
Opcode Fuzzy Hash: fece503bb0dcbedb4a5512cd4b4061a00e61f62ca85ca40b4852577ecf14b4ce
Instruction Fuzzy Hash: 764107B1E41218EBEB10DFA4DE49FEDBB79FB48705F108118E601BA280D7B5A911CB24

Uniqueness

Uniqueness Score: -1.00%

Function 04FA1151, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 254windowtimeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 04FA1104
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 04FA1114
DispatchMessageW.USER32 ref: 04FA1136

Strings

x _n, xrefs: 04FA1151

Memory Dump Source

Source File: 0000000C.00000002.358957054.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer
String ID: x _n
API String ID: 2110285445-548084811
Opcode ID: 06e1b1ddaf1fa4134ea808dc36cc27aa43a9659b72be87d17701ea73c9f48d39
Instruction ID: 54030ae1ef5e239b8287f063edd4c7fee7610e4d9c8620c1ebd7c31c832a1e4e
Opcode Fuzzy Hash: 06e1b1ddaf1fa4134ea808dc36cc27aa43a9659b72be87d17701ea73c9f48d39
Instruction Fuzzy Hash: 888184B6A082559FDB21CF70DA89BD9BBB5EB42308F15459EE001AB193C370B423CB95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: wermgr.exe PID: 6380 Parent PID: 6328 wermgr.exeCOMMON

Executed Functions

Function 0000024B66AF8FF0, Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1014timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 0000024B66AF99BB
RtlAddVectoredContinueHandler.NTDLL ref: 0000024B66AF9A69

Part of subcall function 0000024B66AEAC30: FindFirstFileW.KERNELBASE ref: 0000024B66AEAC91

Part of subcall function 0000024B66AEAC30: FindNextFileW.KERNELBASE ref: 0000024B66AEADC7

Strings

d, xrefs: 0000024B66AF9851

Memory Dump Source

Source File: 0000000E.00000002.642328438.0000024B66AE0000.00000040.00000001.sdmp, Offset: 0000024B66AE0000, based on PE: false

Similarity

API ID: FileFind$ContinueFirstHandlerNextTimerVectored
String ID: d
API String ID: 2222588226-2564639436
Opcode ID: 66e2ea7a873b2f0afbe50fc41cfeff26750be3376995d6ec75ad7dd14b4e7887
Instruction ID: b74099f017b6a485f5d6ce5c5589ec13cfb414b266086b900a30263f7e14f2f5
Opcode Fuzzy Hash: 66e2ea7a873b2f0afbe50fc41cfeff26750be3376995d6ec75ad7dd14b4e7887
Instruction Fuzzy Hash: 68727F30618A088FF796EF78D95976A73D9FB94700F02452A940AC32E2DF78D856CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0000024B66AEDBE0, Relevance: 1.8, APIs: 1, Instructions: 301COMMON

Download Yara Rule

APIs

Part of subcall function 0000024B66B04D80: HeapCreate.KERNELBASE(000000E4,?,?,?,?,?,?,?,0000024B66AE1023), ref: 0000024B66B04DC5

getaddrinfo.WS2_32 ref: 0000024B66AEDD88

Memory Dump Source

Source File: 0000000E.00000002.642328438.0000024B66AE0000.00000040.00000001.sdmp, Offset: 0000024B66AE0000, based on PE: false

Similarity

API ID: CreateHeapgetaddrinfo
String ID:
API String ID: 1115891083-0
Opcode ID: d476593fc6393f0a29d2e40958d0412ed13dc864623e2812d8e61c53356b24d4
Instruction ID: 7b8f59bdd8ed62a14c36944f72cdab3afeb258176f2c8200835ea88f04e18d93
Opcode Fuzzy Hash: d476593fc6393f0a29d2e40958d0412ed13dc864623e2812d8e61c53356b24d4
Instruction Fuzzy Hash: 34814A3121CF094BF7AAAB38949D7BAB6DAFBD5B40F52011CE446C32D2DF64D806D642

Uniqueness

Uniqueness Score: -1.00%

Function 0000024B66AEF350, Relevance: 3.3, APIs: 2, Instructions: 261threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0000024B66AEF57D
SleepEx.KERNEL32 ref: 0000024B66AEF58C

Memory Dump Source

Source File: 0000000E.00000002.642328438.0000024B66AE0000.00000040.00000001.sdmp, Offset: 0000024B66AE0000, based on PE: false

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 1e88f74eeeba97a0e82f472f6d57454e3a83ba4e2a26d2b2e74b4d2555db0ecc
Instruction ID: 351da4aea5927d7420223e74763ba86ff8b5b498f999bb042b431ede2fb79158
Opcode Fuzzy Hash: 1e88f74eeeba97a0e82f472f6d57454e3a83ba4e2a26d2b2e74b4d2555db0ecc
Instruction Fuzzy Hash: 4981FD7060CB488FEBA5EF1CD489B9AB7E4FB98710F50491EE08DC3261D770E9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000024B66B008C0, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE ref: 0000024B66B008F7

Memory Dump Source

Source File: 0000000E.00000002.642328438.0000024B66AE0000.00000040.00000001.sdmp, Offset: 0000024B66AE0000, based on PE: false

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 39b4691e9f5ff846a0ab505c038bda9a1d8a1201d1894d11fca8fd06307ad418
Instruction ID: 2ec5254b820f1a8a39c9e58a36711627e5cc7f48b3dee0e8fd83a0a0809c46af
Opcode Fuzzy Hash: 39b4691e9f5ff846a0ab505c038bda9a1d8a1201d1894d11fca8fd06307ad418
Instruction Fuzzy Hash: F7518F3191C644CBF7769B24C4897EF76D9F794700F6A491AD08AC21C1CB78D985C6C2

Uniqueness

Uniqueness Score: -1.00%

Function 0000024B66A80000, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 0000024B66A80027

Memory Dump Source

Source File: 0000000E.00000002.642283977.0000024B66A80000.00000040.00000001.sdmp, Offset: 0000024B66A80000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction ID: 40c34ad86a3bbcc3bdb285029600600ef503dde0315923b3aa293a6f334b6247
Opcode Fuzzy Hash: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction Fuzzy Hash: D4D05E205059099FD6B6EB7DC848B2622F8DB88710F16024E902DC3191CB10EC1187D1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Trickbot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Function 047F1010, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON

Function 04B01010, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON