Windows Analysis Report
Loki.dll.dll

Overview

General Information

Sample name: Loki.dll.dll
(renamed file extension from exe to dll)
Original sample name: Loki.dll.exe
Analysis ID: 1528326
MD5: 00011cf661d1611ff66531a71269a5de
SHA1: 58728362d2e3f8ebde3f8b8d145e6b25b353abfc
SHA256: 0911a1db0d352180f12241c3854af928c8c6089664710e427244c05ca43be097
Tags: exeuser-ownagesbot
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Tries to detect virtualization through RDTSC time measurements
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to detect virtual machines (SGDT)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Source: rundll32.exe, 00000003.00000002.2274684532.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_f3e8a424-c
Source: Loki.dll.dll Static PE information: certificate valid
Source: Loki.dll.dll Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Source: Binary string: ws2_32.pdb source: rundll32.exe, 00000003.00000002.2274212830.0000021814F00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2173625284.0000021813377000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175820024.000002D681BA0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173257832.000002D6FCCF9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357460990.0000018301A50000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221095074.000001837E357000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.2438748996.0000014A18910000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2244967373.0000014A16D47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391206194.000001C53D2E7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449540178.000001C53EE40000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357842818.000001D1C9380000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2392675504.000001D1C7847000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2391538126.000002146B547000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2555190256.000002146D070000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2393412606.000001B229AB7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.2561529000.000001B22B590000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: rundll32.exe, 00000003.00000003.2172586529.0000021814FB5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2174670186.00000218158CD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175998543.000002D68216D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2172571112.000002D681A52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2220742215.0000018301B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357810985.000001830205D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2243975595.0000014A188AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437325258.0000014A193BD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2396148768.000001C53F8ED000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2390583152.000001C53EDD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2390331760.000001D1C9315000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3358064086.000001D1C9E2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2390614846.000002146D11F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553128701.000002146DC2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559685319.000001B22C15D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2391390330.000001B22B645000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000003.00000003.2172586529.0000021814FB5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2174670186.00000218158CD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175998543.000002D68216D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2172571112.000002D681A52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2220742215.0000018301B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357810985.000001830205D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2243975595.0000014A188AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437325258.0000014A193BD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2396148768.000001C53F8ED000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2390583152.000001C53EDD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2390331760.000001D1C9315000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3358064086.000001D1C9E2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2390614846.000002146D11F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553128701.000002146DC2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559685319.000001B22C15D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2391390330.000001B22B645000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: win32u.pdb source: rundll32.exe, 00000003.00000003.2174285400.000002181337C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2274108990.00000218135CC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175713708.000002D6818BC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173418988.000002D6FCCFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2225027482.000001837E35B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357365604.00000183019AC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2245188149.0000014A16D4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437575985.0000014A186FC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391739274.000001C53D2EB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449648800.000001C53EEEC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2393720762.000001D1C784B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357719592.000001D1C913C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2392001418.000002146B54B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553527917.000002146D00C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2396232233.000001B229ABB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559980410.000001B22B4BC000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: win32u.pdbGCTL source: rundll32.exe, 00000003.00000003.2174285400.000002181337C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2274108990.00000218135CC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175713708.000002D6818BC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173418988.000002D6FCCFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2225027482.000001837E35B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357365604.00000183019AC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2245188149.0000014A16D4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437575985.0000014A186FC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391739274.000001C53D2EB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449648800.000001C53EEEC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2393720762.000001D1C784B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357719592.000001D1C913C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2392001418.000002146B54B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553527917.000002146D00C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2396232233.000001B229ABB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559980410.000001B22B4BC000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: ws2_32.pdbUGP source: rundll32.exe, 00000003.00000002.2274212830.0000021814F00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2173625284.0000021813377000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175820024.000002D681BA0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173257832.000002D6FCCF9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357460990.0000018301A50000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221095074.000001837E357000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.2438748996.0000014A18910000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2244967373.0000014A16D47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391206194.000001C53D2E7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449540178.000001C53EE40000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357842818.000001D1C9380000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2392675504.000001D1C7847000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2391538126.000002146B547000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2555190256.000002146D070000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2393412606.000001B229AB7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.2561529000.000001B22B590000.00000004.00001000.00020000.00000000.sdmp
Source: Amcache.hve.10.dr String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://whatismyip.akamai.com
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://whatismyip.akamai.comNGmem
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://whatismyip.akamai.comem1.
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://whatismyip.akamai.comemILhg
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://whatismyip.akamai.comly
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.ggn.live/api/configs/public-ip
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.ggn.live/api/configs/public-ip85P
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357207513.0000001C3187D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357213695.0000000A81EFC000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.myip.la
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.myip.la07ilesCoNg
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.myip.la6)
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.myip.lall
Source: rundll32.exe, 00000006.00000002.3357207513.0000001C3187D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357213695.0000000A81EFC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://api.myip.laq
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.myip.laxe_Numom
Source: rundll32.exe, 00000003.00000002.2274684532.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.3358585398.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.3358598696.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rundll32.exe, 00000003.00000002.2274684532.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.3358585398.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.3358598696.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: rundll32.exe, 00000003.00000002.2274684532.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.3358585398.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.3358598696.00007FFD8F65B000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://icanhazip.com
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://icanhazip.comPCespace
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://icanhazip.comamespacezg
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://icanhazip.comonUsers
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://icanhazip.coms(x86)=C:
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/ip
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/ipData
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/ipE=ALD64umCo
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/iplRINGmS;.g
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/ipon
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://myexternalip.com/raw
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://myexternalip.com/raw6)=C:Mg#
Source: rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://myexternalip.com/rawITECT
Source: rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://myexternalip.com/rawOS=Wi
Installs a raw input device (often for capturing keystrokes)
Source: rundll32.exe, 00000003.00000003.2174285400.000002181337C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NtUserGetRawInputData memstr_f90e7c8c-9

System Summary
barindex
PE file contains section with special chars
Source: Loki.dll.dll Static PE information: section name: .o:)
Source: Loki.dll.dll Static PE information: section name: .Mj)
Source: Loki.dll.dll Static PE information: section name: .V{m
Source: Loki.dll.dll Static PE information: section name: .n+\
Source: Loki.dll.dll Static PE information: section name: .M>L
Source: Loki.dll.dll Static PE information: section name: .`E%
Source: Loki.dll.dll Static PE information: section name: .3%X
Contains functionality to call native functions
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_000002181584D310 NtQueryInformationProcess, 3_3_000002181584D310
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_000002181584D1D0 NtClose, 3_3_000002181584D1D0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FDD310 NtQueryInformationProcess, 6_2_0000018301FDD310
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1933D310 NtQueryInformationProcess, 9_3_0000014A1933D310
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F86D310 NtQueryInformationProcess, 14_3_000001C53F86D310
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DAD310 NtQueryInformationProcess, 15_2_000001D1C9DAD310
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DBAD310 NtQueryInformationProcess, 16_3_000002146DBAD310
Source: C:\Windows\System32\rundll32.exe Code function: 17_3_000001B22C0DD310 NtQueryInformationProcess, 17_3_000001B22C0DD310
Detected potential crypto function
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C7450 3_3_00000218157C7450
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157BA448 3_3_00000218157BA448
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CB430 3_3_00000218157CB430
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CD390 3_3_00000218157CD390
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DF380 3_3_00000218157DF380
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158303AC 3_3_00000218158303AC
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157BE348 3_3_00000218157BE348
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B3404 3_3_00000218157B3404
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157E03F4 3_3_00000218157E03F4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DF690 3_3_00000218157DF690
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DB650 3_3_00000218157DB650
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CF630 3_3_00000218157CF630
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D261F 3_3_00000218157D261F
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D5710 3_3_00000218157D5710
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D2580 3_3_00000218157D2580
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D8543 3_3_00000218157D8543
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157F05F8 3_3_00000218157F05F8
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158C9594 3_3_00000218158C9594
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815822590 3_3_0000021815822590
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157BA090 3_3_00000218157BA090
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C404C 3_3_00000218157C404C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DA104 3_3_00000218157DA104
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158A507C 3_3_00000218158A507C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B4F78 3_3_00000218157B4F78
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B1F60 3_3_00000218157B1F60
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815821FD4 3_3_0000021815821FD4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CAF50 3_3_00000218157CAF50
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158B7FE4 3_3_00000218158B7FE4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815847FF4 3_3_0000021815847FF4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158BBFE8 3_3_00000218158BBFE8
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D4FE0 3_3_00000218157D4FE0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B8FE4 3_3_00000218157B8FE4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B3FA4 3_3_00000218157B3FA4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D9280 3_3_00000218157D9280
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DC316 3_3_00000218157DC316
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C12E0 3_3_00000218157C12E0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CE2D8 3_3_00000218157CE2D8
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_000002181588F26C 3_3_000002181588F26C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CC2B4 3_3_00000218157CC2B4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D4160 3_3_00000218157D4160
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DA212 3_3_00000218157DA212
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D71D0 3_3_00000218157D71D0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815843180 3_3_0000021815843180
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C9C40 3_3_00000218157C9C40
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CEC28 3_3_00000218157CEC28
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_000002181581BC18 3_3_000002181581BC18
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815813C20 3_3_0000021815813C20
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158B8C28 3_3_00000218158B8C28
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158BBC8C 3_3_00000218158BBC8C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157BDB60 3_3_00000218157BDB60
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B5B5C 3_3_00000218157B5B5C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158A6BD8 3_3_00000218158A6BD8
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158A9B20 3_3_00000218158A9B20
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D5C00 3_3_00000218157D5C00
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C7BE0 3_3_00000218157C7BE0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158A6E98 3_3_00000218158A6E98
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815826EF0 3_3_0000021815826EF0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158AAF00 3_3_00000218158AAF00
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815820E28 3_3_0000021815820E28
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CFEF8 3_3_00000218157CFEF8
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C6EE4 3_3_00000218157C6EE4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CEEB4 3_3_00000218157CEEB4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B2D40 3_3_00000218157B2D40
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D7E0A 3_3_00000218157D7E0A
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C2DE0 3_3_00000218157C2DE0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815814D58 3_3_0000021815814D58
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DFDC0 3_3_00000218157DFDC0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D8DBF 3_3_00000218157D8DBF
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158BFD88 3_3_00000218158BFD88
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B3888 3_3_00000218157B3888
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157C1840 3_3_00000218157C1840
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D782C 3_3_00000218157D782C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157BA8B0 3_3_00000218157BA8B0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157E18A0 3_3_00000218157E18A0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157BB780 3_3_00000218157BB780
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DC765 3_3_00000218157DC765
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815803740 3_3_0000021815803740
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158AA764 3_3_00000218158AA764
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158BEABC 3_3_00000218158BEABC
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158BFAD4 3_3_00000218158BFAD4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815822ADC 3_3_0000021815822ADC
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DAA20 3_3_00000218157DAA20
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CCA18 3_3_00000218157CCA18
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815849A1C 3_3_0000021815849A1C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815803A5C 3_3_0000021815803A5C
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D3990 3_3_00000218157D3990
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157B2980 3_3_00000218157B2980
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218158BF9E0 3_3_00000218158BF9E0
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CE940 3_3_00000218157CE940
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_000002181580AA00 3_3_000002181580AA00
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_000002181584C920 3_3_000002181584C920
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_0000021815885930 3_3_0000021815885930
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157D19E4 3_3_00000218157D19E4
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157CA9E0 3_3_00000218157CA9E0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6C316 6_2_0000018301F6C316
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5E2D8 6_2_0000018301F5E2D8
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F512E0 6_2_0000018301F512E0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5C2B4 6_2_0000018301F5C2B4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F69280 6_2_0000018301F69280
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6A212 6_2_0000018301F6A212
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F671D0 6_2_0000018301F671D0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FD3180 6_2_0000018301FD3180
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F64160 6_2_0000018301F64160
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F4A448 6_2_0000018301F4A448
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F57450 6_2_0000018301F57450
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5B430 6_2_0000018301F5B430
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F43404 6_2_0000018301F43404
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F703F4 6_2_0000018301F703F4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830201F26C 6_2_000001830201F26C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FC03AC 6_2_0000018301FC03AC
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5D390 6_2_0000018301F5D390
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6F380 6_2_0000018301F6F380
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F4E348 6_2_0000018301F4E348
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F65710 6_2_0000018301F65710
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830203A764 6_2_000001830203A764
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6F690 6_2_0000018301F6F690
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6B650 6_2_0000018301F6B650
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5F630 6_2_0000018301F5F630
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6261F 6_2_0000018301F6261F
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F805F8 6_2_0000018301F805F8
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FB2590 6_2_0000018301FB2590
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F62580 6_2_0000018301F62580
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F68543 6_2_0000018301F68543
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FDC920 6_2_0000018301FDC920
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302059594 6_2_0000018302059594
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F4A8B0 6_2_0000018301F4A8B0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F718A0 6_2_0000018301F718A0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F43888 6_2_0000018301F43888
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F51840 6_2_0000018301F51840
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6782C 6_2_0000018301F6782C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F4B780 6_2_0000018301F4B780
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6C765 6_2_0000018301F6C765
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F93740 6_2_0000018301F93740
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FB2ADC 6_2_0000018301FB2ADC
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302036BD8 6_2_0000018302036BD8
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F93A5C 6_2_0000018301F93A5C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5CA18 6_2_0000018301F5CA18
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302048C28 6_2_0000018302048C28
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FD9A1C 6_2_0000018301FD9A1C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6AA20 6_2_0000018301F6AA20
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F9AA00 6_2_0000018301F9AA00
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F619E4 6_2_0000018301F619E4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5A9E0 6_2_0000018301F5A9E0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830204BC8C 6_2_000001830204BC8C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F63990 6_2_0000018301F63990
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F42980 6_2_0000018301F42980
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5E940 6_2_0000018301F5E940
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302015930 6_2_0000018302015930
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830204F9E0 6_2_000001830204F9E0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F59C40 6_2_0000018301F59C40
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5EC28 6_2_0000018301F5EC28
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FA3C20 6_2_0000018301FA3C20
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FABC18 6_2_0000018301FABC18
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F65C00 6_2_0000018301F65C00
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F57BE0 6_2_0000018301F57BE0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830204EABC 6_2_000001830204EABC
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830204FAD4 6_2_000001830204FAD4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F4DB60 6_2_0000018301F4DB60
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F45B5C 6_2_0000018301F45B5C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302039B20 6_2_0000018302039B20
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5FEF8 6_2_0000018301F5FEF8
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F56EE4 6_2_0000018301F56EE4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FB6EF0 6_2_0000018301FB6EF0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5EEB4 6_2_0000018301F5EEB4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830204BFE8 6_2_000001830204BFE8
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302047FE4 6_2_0000018302047FE4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FB0E28 6_2_0000018301FB0E28
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F67E0A 6_2_0000018301F67E0A
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F52DE0 6_2_0000018301F52DE0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830203507C 6_2_000001830203507C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6FDC0 6_2_0000018301F6FDC0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F68DBF 6_2_0000018301F68DBF
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FA4D58 6_2_0000018301FA4D58
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F42D40 6_2_0000018301F42D40
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F6A104 6_2_0000018301F6A104
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830204FD88 6_2_000001830204FD88
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F4A090 6_2_0000018301F4A090
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5404C 6_2_0000018301F5404C
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FD7FF4 6_2_0000018301FD7FF4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F48FE4 6_2_0000018301F48FE4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301FB1FD4 6_2_0000018301FB1FD4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F64FE0 6_2_0000018301F64FE0
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F43FA4 6_2_0000018301F43FA4
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018302036E98 6_2_0000018302036E98
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F44F78 6_2_0000018301F44F78
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F41F60 6_2_0000018301F41F60
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_0000018301F5AF50 6_2_0000018301F5AF50
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000001830203AF00 6_2_000001830203AF00
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19333180 9_3_0000014A19333180
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C4160 9_3_0000014A192C4160
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C71D0 9_3_0000014A192C71D0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1939507C 9_3_0000014A1939507C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B404C 9_3_0000014A192B404C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192AA090 9_3_0000014A192AA090
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CA104 9_3_0000014A192CA104
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192AE348 9_3_0000014A192AE348
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CC316 9_3_0000014A192CC316
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CF380 9_3_0000014A192CF380
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193203AC 9_3_0000014A193203AC
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BD390 9_3_0000014A192BD390
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192D03F4 9_3_0000014A192D03F4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A3404 9_3_0000014A192A3404
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CA212 9_3_0000014A192CA212
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C9280 9_3_0000014A192C9280
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1937F26C 9_3_0000014A1937F26C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BC2B4 9_3_0000014A192BC2B4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BE2D8 9_3_0000014A192BE2D8
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B12E0 9_3_0000014A192B12E0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C8543 9_3_0000014A192C8543
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C2580 9_3_0000014A192C2580
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193B9594 9_3_0000014A193B9594
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19312590 9_3_0000014A19312590
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192E05F8 9_3_0000014A192E05F8
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BB430 9_3_0000014A192BB430
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192AA448 9_3_0000014A192AA448
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B7450 9_3_0000014A192B7450
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192F3740 9_3_0000014A192F3740
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C5710 9_3_0000014A192C5710
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192AB780 9_3_0000014A192AB780
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1939A764 9_3_0000014A1939A764
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CC765 9_3_0000014A192CC765
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BF630 9_3_0000014A192BF630
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C261F 9_3_0000014A192C261F
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CB650 9_3_0000014A192CB650
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CF690 9_3_0000014A192CF690
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19375930 9_3_0000014A19375930
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BE940 9_3_0000014A192BE940
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1933C920 9_3_0000014A1933C920
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A2980 9_3_0000014A192A2980
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C3990 9_3_0000014A192C3990
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192FAA00 9_3_0000014A192FAA00
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193AF9E0 9_3_0000014A193AF9E0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C19E4 9_3_0000014A192C19E4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BA9E0 9_3_0000014A192BA9E0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C782C 9_3_0000014A192C782C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B1840 9_3_0000014A192B1840
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A3888 9_3_0000014A192A3888
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192AA8B0 9_3_0000014A192AA8B0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192D18A0 9_3_0000014A192D18A0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19399B20 9_3_0000014A19399B20
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A5B5C 9_3_0000014A192A5B5C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192ADB60 9_3_0000014A192ADB60
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C5C00 9_3_0000014A192C5C00
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19396BD8 9_3_0000014A19396BD8
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B7BE0 9_3_0000014A192B7BE0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19339A1C 9_3_0000014A19339A1C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BCA18 9_3_0000014A192BCA18
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CAA20 9_3_0000014A192CAA20
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192F3A5C 9_3_0000014A192F3A5C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193AEABC 9_3_0000014A193AEABC
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19312ADC 9_3_0000014A19312ADC
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193AFAD4 9_3_0000014A193AFAD4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A2D40 9_3_0000014A192A2D40
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193AFD88 9_3_0000014A193AFD88
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19304D58 9_3_0000014A19304D58
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C8DBF 9_3_0000014A192C8DBF
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192CFDC0 9_3_0000014A192CFDC0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B2DE0 9_3_0000014A192B2DE0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B9C40 9_3_0000014A192B9C40
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193A8C28 9_3_0000014A193A8C28
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19303C20 9_3_0000014A19303C20
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BEC28 9_3_0000014A192BEC28
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1930BC18 9_3_0000014A1930BC18
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193ABC8C 9_3_0000014A193ABC8C
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A4F78 9_3_0000014A192A4F78
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BAF50 9_3_0000014A192BAF50
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A1F60 9_3_0000014A192A1F60
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A3FA4 9_3_0000014A192A3FA4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19337FF4 9_3_0000014A19337FF4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193A7FE4 9_3_0000014A193A7FE4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A193ABFE8 9_3_0000014A193ABFE8
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192A8FE4 9_3_0000014A192A8FE4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C4FE0 9_3_0000014A192C4FE0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19311FD4 9_3_0000014A19311FD4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192C7E0A 9_3_0000014A192C7E0A
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19310E28 9_3_0000014A19310E28
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BEEB4 9_3_0000014A192BEEB4
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19396E98 9_3_0000014A19396E98
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192BFEF8 9_3_0000014A192BFEF8
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A1939AF00 9_3_0000014A1939AF00
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A19316EF0 9_3_0000014A19316EF0
Source: C:\Windows\System32\rundll32.exe Code function: 9_3_0000014A192B6EE4 9_3_0000014A192B6EE4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D3888 14_3_000001C53F7D3888
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E1840 14_3_000001C53F7E1840
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F782C 14_3_000001C53F7F782C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F86C920 14_3_000001C53F86C920
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7DA8B0 14_3_000001C53F7DA8B0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8018A0 14_3_000001C53F8018A0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7DB780 14_3_000001C53F7DB780
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FC765 14_3_000001C53F7FC765
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F823740 14_3_000001C53F823740
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8CA764 14_3_000001C53F8CA764
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FB650 14_3_000001C53F7FB650
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EF630 14_3_000001C53F7EF630
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F5710 14_3_000001C53F7F5710
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FF690 14_3_000001C53F7FF690
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F2580 14_3_000001C53F7F2580
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8105F8 14_3_000001C53F8105F8
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F8543 14_3_000001C53F7F8543
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F261F 14_3_000001C53F7F261F
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8E9594 14_3_000001C53F8E9594
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F842590 14_3_000001C53F842590
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E7450 14_3_000001C53F7E7450
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7DA448 14_3_000001C53F7DA448
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EB430 14_3_000001C53F7EB430
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8503AC 14_3_000001C53F8503AC
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7ED390 14_3_000001C53F7ED390
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8003F4 14_3_000001C53F8003F4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7DE348 14_3_000001C53F7DE348
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D3404 14_3_000001C53F7D3404
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FF380 14_3_000001C53F7FF380
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F9280 14_3_000001C53F7F9280
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FC316 14_3_000001C53F7FC316
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E12E0 14_3_000001C53F7E12E0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EE2D8 14_3_000001C53F7EE2D8
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8AF26C 14_3_000001C53F8AF26C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EC2B4 14_3_000001C53F7EC2B4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F4160 14_3_000001C53F7F4160
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FA212 14_3_000001C53F7FA212
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F71D0 14_3_000001C53F7F71D0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F863180 14_3_000001C53F863180
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7DA090 14_3_000001C53F7DA090
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E404C 14_3_000001C53F7E404C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FA104 14_3_000001C53F7FA104
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8C507C 14_3_000001C53F8C507C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D3FA4 14_3_000001C53F7D3FA4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F841FD4 14_3_000001C53F841FD4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D4F78 14_3_000001C53F7D4F78
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8D7FE4 14_3_000001C53F8D7FE4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D1F60 14_3_000001C53F7D1F60
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F867FF4 14_3_000001C53F867FF4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8DBFE8 14_3_000001C53F8DBFE8
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EAF50 14_3_000001C53F7EAF50
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D8FE4 14_3_000001C53F7D8FE4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F4FE0 14_3_000001C53F7F4FE0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F846EF0 14_3_000001C53F846EF0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8CAF00 14_3_000001C53F8CAF00
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F840E28 14_3_000001C53F840E28
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EFEF8 14_3_000001C53F7EFEF8
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E6EE4 14_3_000001C53F7E6EE4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EEEB4 14_3_000001C53F7EEEB4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8C6E98 14_3_000001C53F8C6E98
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FFDC0 14_3_000001C53F7FFDC0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D2D40 14_3_000001C53F7D2D40
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F7E0A 14_3_000001C53F7F7E0A
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F834D58 14_3_000001C53F834D58
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E2DE0 14_3_000001C53F7E2DE0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F8DBF 14_3_000001C53F7F8DBF
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8DFD88 14_3_000001C53F8DFD88
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E9C40 14_3_000001C53F7E9C40
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EEC28 14_3_000001C53F7EEC28
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8D8C28 14_3_000001C53F8D8C28
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8DBC8C 14_3_000001C53F8DBC8C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8C6BD8 14_3_000001C53F8C6BD8
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7DDB60 14_3_000001C53F7DDB60
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D5B5C 14_3_000001C53F7D5B5C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F83BC18 14_3_000001C53F83BC18
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F833C20 14_3_000001C53F833C20
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F5C00 14_3_000001C53F7F5C00
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7E7BE0 14_3_000001C53F7E7BE0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8DEABC 14_3_000001C53F8DEABC
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8DFAD4 14_3_000001C53F8DFAD4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F842ADC 14_3_000001C53F842ADC
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8C9B20 14_3_000001C53F8C9B20
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F823A5C 14_3_000001C53F823A5C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F3990 14_3_000001C53F7F3990
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7D2980 14_3_000001C53F7D2980
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8DF9E0 14_3_000001C53F8DF9E0
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F82AA00 14_3_000001C53F82AA00
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EE940 14_3_000001C53F7EE940
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F869A1C 14_3_000001C53F869A1C
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F8A5930 14_3_000001C53F8A5930
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7FAA20 14_3_000001C53F7FAA20
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7ECA18 14_3_000001C53F7ECA18
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7F19E4 14_3_000001C53F7F19E4
Source: C:\Windows\System32\rundll32.exe Code function: 14_3_000001C53F7EA9E0 14_3_000001C53F7EA9E0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DA3180 15_2_000001D1C9DA3180
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D34160 15_2_000001D1C9D34160
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3A104 15_2_000001D1C9D3A104
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D1A090 15_2_000001D1C9D1A090
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E0507C 15_2_000001D1C9E0507C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2404C 15_2_000001D1C9D2404C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DA7FF4 15_2_000001D1C9DA7FF4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E17FE4 15_2_000001D1C9E17FE4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E1BFE8 15_2_000001D1C9E1BFE8
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D18FE4 15_2_000001D1C9D18FE4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D81FD4 15_2_000001D1C9D81FD4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D34FE0 15_2_000001D1C9D34FE0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2D390 15_2_000001D1C9D2D390
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3F380 15_2_000001D1C9D3F380
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D903AC 15_2_000001D1C9D903AC
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D1E348 15_2_000001D1C9D1E348
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3C316 15_2_000001D1C9D3C316
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2C2B4 15_2_000001D1C9D2C2B4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2E2D8 15_2_000001D1C9D2E2D8
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D212E0 15_2_000001D1C9D212E0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D39280 15_2_000001D1C9D39280
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DEF26C 15_2_000001D1C9DEF26C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3A212 15_2_000001D1C9D3A212
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D371D0 15_2_000001D1C9D371D0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E29594 15_2_000001D1C9E29594
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D82590 15_2_000001D1C9D82590
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D32580 15_2_000001D1C9D32580
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D38543 15_2_000001D1C9D38543
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D1A448 15_2_000001D1C9D1A448
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D27450 15_2_000001D1C9D27450
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D13404 15_2_000001D1C9D13404
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D403F4 15_2_000001D1C9D403F4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2B430 15_2_000001D1C9D2B430
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D1B780 15_2_000001D1C9D1B780
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E0A764 15_2_000001D1C9E0A764
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D63740 15_2_000001D1C9D63740
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3C765 15_2_000001D1C9D3C765
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D35710 15_2_000001D1C9D35710
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3F690 15_2_000001D1C9D3F690
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3B650 15_2_000001D1C9D3B650
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D505F8 15_2_000001D1C9D505F8
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2F630 15_2_000001D1C9D2F630
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3261F 15_2_000001D1C9D3261F
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D33990 15_2_000001D1C9D33990
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D12980 15_2_000001D1C9D12980
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2E940 15_2_000001D1C9D2E940
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DE5930 15_2_000001D1C9DE5930
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DAC920 15_2_000001D1C9DAC920
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D13888 15_2_000001D1C9D13888
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D1A8B0 15_2_000001D1C9D1A8B0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D418A0 15_2_000001D1C9D418A0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D21840 15_2_000001D1C9D21840
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3782C 15_2_000001D1C9D3782C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D15B5C 15_2_000001D1C9D15B5C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D1DB60 15_2_000001D1C9D1DB60
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E09B20 15_2_000001D1C9E09B20
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E1FAD4 15_2_000001D1C9E1FAD4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E1EABC 15_2_000001D1C9E1EABC
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D82ADC 15_2_000001D1C9D82ADC
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D63A5C 15_2_000001D1C9D63A5C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D6AA00 15_2_000001D1C9D6AA00
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9DA9A1C 15_2_000001D1C9DA9A1C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2CA18 15_2_000001D1C9D2CA18
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3AA20 15_2_000001D1C9D3AA20
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E1F9E0 15_2_000001D1C9E1F9E0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D319E4 15_2_000001D1C9D319E4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2A9E0 15_2_000001D1C9D2A9E0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E1FD88 15_2_000001D1C9E1FD88
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D12D40 15_2_000001D1C9D12D40
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D74D58 15_2_000001D1C9D74D58
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E1BC8C 15_2_000001D1C9E1BC8C
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D29C40 15_2_000001D1C9D29C40
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E18C28 15_2_000001D1C9E18C28
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D35C00 15_2_000001D1C9D35C00
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2EC28 15_2_000001D1C9D2EC28
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D7BC18 15_2_000001D1C9D7BC18
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D73C20 15_2_000001D1C9D73C20
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E06BD8 15_2_000001D1C9E06BD8
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D27BE0 15_2_000001D1C9D27BE0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D14F78 15_2_000001D1C9D14F78
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D13FA4 15_2_000001D1C9D13FA4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2AF50 15_2_000001D1C9D2AF50
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D11F60 15_2_000001D1C9D11F60
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2FEF8 15_2_000001D1C9D2FEF8
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E0AF00 15_2_000001D1C9E0AF00
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D2EEB4 15_2_000001D1C9D2EEB4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D26EE4 15_2_000001D1C9D26EE4
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D86EF0 15_2_000001D1C9D86EF0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9E06E98 15_2_000001D1C9E06E98
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D37E0A 15_2_000001D1C9D37E0A
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D80E28 15_2_000001D1C9D80E28
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D3FDC0 15_2_000001D1C9D3FDC0
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D38DBF 15_2_000001D1C9D38DBF
Source: C:\Windows\System32\rundll32.exe Code function: 15_2_000001D1C9D22DE0 15_2_000001D1C9D22DE0
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB12D40 16_3_000002146DB12D40
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DC1FD88 16_3_000002146DC1FD88
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB74D58 16_3_000002146DB74D58
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB29C40 16_3_000002146DB29C40
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB2EC28 16_3_000002146DB2EC28
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB7BC18 16_3_000002146DB7BC18
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DC1BC8C 16_3_000002146DC1BC8C
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB73C20 16_3_000002146DB73C20
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DC18C28 16_3_000002146DC18C28
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DC06BD8 16_3_000002146DC06BD8
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB35C00 16_3_000002146DB35C00
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB27BE0 16_3_000002146DB27BE0
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB2AF50 16_3_000002146DB2AF50
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB14F78 16_3_000002146DB14F78
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB11F60 16_3_000002146DB11F60
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB2EEB4 16_3_000002146DB2EEB4
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DC0AF00 16_3_000002146DC0AF00
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DC06E98 16_3_000002146DC06E98
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB2FEF8 16_3_000002146DB2FEF8
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB26EE4 16_3_000002146DB26EE4
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB86EF0 16_3_000002146DB86EF0
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB80E28 16_3_000002146DB80E28
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB3FDC0 16_3_000002146DB3FDC0
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB38DBF 16_3_000002146DB38DBF
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB37E0A 16_3_000002146DB37E0A
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB22DE0 16_3_000002146DB22DE0
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB2E940 16_3_000002146DB2E940
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DBE5930 16_3_000002146DBE5930
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DBAC920 16_3_000002146DBAC920
Source: C:\Windows\System32\rundll32.exe Code function: 16_3_000002146DB33990 16_3_000002146DB33990
Found potential string decryption / allocating functions
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000002146DB60340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 0000014A192F0340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001D1C9DDDCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000002181587DCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001C53F89DCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 0000014A192F09B0 appears 184 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 0000018301F90340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001C53F820340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001B22C090340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000002146DBDDCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 00000218158009B0 appears 184 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 0000021815800340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 0000018301F909B0 appears 184 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001B22C10DCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001830200DCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001C53F8209B0 appears 184 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001B22C0909B0 appears 184 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001D1C9D60340 appears 62 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 0000014A1936DCA8 appears 61 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000001D1C9D609B0 appears 184 times
Source: C:\Windows\System32\rundll32.exe Code function: String function: 000002146DB609B0 appears 184 times
One or more processes crash
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2496 -s 528
Source: classification engine Classification label: mal60.evad.winDLL@24/17@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4188:120:WilError_03
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2496
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5448
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\97f55fb0-bd8d-4371-8a5f-1f20fec0900f Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,Finalize
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Loki.dll.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,Finalize
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,Initialize
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,InitializeDataA
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2496 -s 528
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2496 -s 452
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",Finalize
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",Initialize
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",InitializeDataA
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",InitializeDataW
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5448 -s 516
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5448 -s 244
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,Finalize Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,Initialize Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Loki.dll.dll,InitializeDataA Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",Finalize Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",Initialize Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",InitializeDataA Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",InitializeDataW Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: fltlib.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Loki.dll.dll Static PE information: certificate valid
Source: Loki.dll.dll Static PE information: Image base 0x180000000 > 0x60000000
Source: Loki.dll.dll Static file information: File size 32211584 > 1048576
Source: Loki.dll.dll Static PE information: Raw size of .M>L is bigger than: 0x100000 < 0x1eb3a00
Source: Loki.dll.dll Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Source: Binary string: ws2_32.pdb source: rundll32.exe, 00000003.00000002.2274212830.0000021814F00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2173625284.0000021813377000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175820024.000002D681BA0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173257832.000002D6FCCF9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357460990.0000018301A50000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221095074.000001837E357000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.2438748996.0000014A18910000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2244967373.0000014A16D47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391206194.000001C53D2E7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449540178.000001C53EE40000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357842818.000001D1C9380000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2392675504.000001D1C7847000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2391538126.000002146B547000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2555190256.000002146D070000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2393412606.000001B229AB7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.2561529000.000001B22B590000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: rundll32.exe, 00000003.00000003.2172586529.0000021814FB5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2174670186.00000218158CD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175998543.000002D68216D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2172571112.000002D681A52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2220742215.0000018301B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357810985.000001830205D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2243975595.0000014A188AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437325258.0000014A193BD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2396148768.000001C53F8ED000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2390583152.000001C53EDD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2390331760.000001D1C9315000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3358064086.000001D1C9E2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2390614846.000002146D11F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553128701.000002146DC2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559685319.000001B22C15D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2391390330.000001B22B645000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000003.00000003.2172586529.0000021814FB5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2174670186.00000218158CD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175998543.000002D68216D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2172571112.000002D681A52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2220742215.0000018301B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357810985.000001830205D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2243975595.0000014A188AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437325258.0000014A193BD000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2396148768.000001C53F8ED000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2390583152.000001C53EDD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2390331760.000001D1C9315000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3358064086.000001D1C9E2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2390614846.000002146D11F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553128701.000002146DC2D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559685319.000001B22C15D000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2391390330.000001B22B645000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: win32u.pdb source: rundll32.exe, 00000003.00000003.2174285400.000002181337C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2274108990.00000218135CC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175713708.000002D6818BC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173418988.000002D6FCCFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2225027482.000001837E35B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357365604.00000183019AC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2245188149.0000014A16D4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437575985.0000014A186FC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391739274.000001C53D2EB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449648800.000001C53EEEC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2393720762.000001D1C784B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357719592.000001D1C913C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2392001418.000002146B54B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553527917.000002146D00C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2396232233.000001B229ABB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559980410.000001B22B4BC000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: win32u.pdbGCTL source: rundll32.exe, 00000003.00000003.2174285400.000002181337C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2274108990.00000218135CC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175713708.000002D6818BC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173418988.000002D6FCCFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2225027482.000001837E35B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357365604.00000183019AC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2245188149.0000014A16D4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437575985.0000014A186FC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391739274.000001C53D2EB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449648800.000001C53EEEC000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2393720762.000001D1C784B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357719592.000001D1C913C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2392001418.000002146B54B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553527917.000002146D00C000.00000002.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2396232233.000001B229ABB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559980410.000001B22B4BC000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: ws2_32.pdbUGP source: rundll32.exe, 00000003.00000002.2274212830.0000021814F00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2173625284.0000021813377000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2175820024.000002D681BA0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2173257832.000002D6FCCF9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3357460990.0000018301A50000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221095074.000001837E357000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.2438748996.0000014A18910000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2244967373.0000014A16D47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2391206194.000001C53D2E7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2449540178.000001C53EE40000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357842818.000001D1C9380000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.2392675504.000001D1C7847000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2391538126.000002146B547000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2555190256.000002146D070000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2393412606.000001B229AB7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.2561529000.000001B22B590000.00000004.00001000.00020000.00000000.sdmp
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .M>L
PE file contains sections with non-standard names
Source: Loki.dll.dll Static PE information: section name: .o:)
Source: Loki.dll.dll Static PE information: section name: .Mj)
Source: Loki.dll.dll Static PE information: section name: .zkV
Source: Loki.dll.dll Static PE information: section name: .V{m
Source: Loki.dll.dll Static PE information: section name: .n+\
Source: Loki.dll.dll Static PE information: section name: .oSA
Source: Loki.dll.dll Static PE information: section name: .M>L
Source: Loki.dll.dll Static PE information: section name: .`E%
Source: Loki.dll.dll Static PE information: section name: .3%X
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000DDB54FC1C8 push ecx; retf 0_2_000000DDB54FC229
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000DDB54FD818 push ecx; retf 0_2_000000DDB54FD8E9
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_000000DDB54FC22A pushfd ; ret 0_2_000000DDB54FC341
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FAEC3A push ecx; retf 4_2_000000DB96FAEDB9
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FADA72 push ecx; retf 4_2_000000DB96FADA79
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FAD99B push ecx; retf 4_2_000000DB96FAD9A9
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FADB9B push ecx; retf 4_2_000000DB96FADBA9
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FAE6E2 pushad ; retf 4_2_000000DB96FAE77F
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FAEBBB push ecx; retf 4_2_000000DB96FAEC39
Source: C:\Windows\System32\rundll32.exe Code function: 4_2_000000DB96FADBC2 push ecx; retf 4_2_000000DB96FADBD9
Source: C:\Windows\System32\rundll32.exe Code function: 9_2_00000018F658D4F8 push ecx; retf 9_2_00000018F658D4F9
Source: C:\Windows\System32\rundll32.exe Code function: 9_2_00000018F658E232 pushad ; retf 9_2_00000018F658E2CF
Source: C:\Windows\System32\rundll32.exe Code function: 9_2_00000018F658D2A8 push ecx; retf 9_2_00000018F658D2A9
Source: C:\Windows\System32\rundll32.exe Code function: 9_2_00000018F658D5C8 push ecx; retf 9_2_00000018F658D5C9
Source: C:\Windows\System32\rundll32.exe Code function: 9_2_00000018F658E70B push ecx; retf 9_2_00000018F658E789
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567D7DA push ecx; retf 14_2_00000070C567D8A9
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567D73B push ecx; retf 14_2_00000070C567D7D9
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567D9DA push ecx; retf 14_2_00000070C567DA09
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567D9CB push ecx; retf 14_2_00000070C567D9D9
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567E9A8 push ecx; retf 14_2_00000070C567EED9
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567E897 push ecx; retf 14_2_00000070C567EED9
Source: C:\Windows\System32\rundll32.exe Code function: 14_2_00000070C567D522 push ecx; retf 14_2_00000070C567D589
Source: C:\Windows\System32\rundll32.exe Code function: 16_2_00000075CE97D80A push ecx; retf 16_2_00000075CE97DAB9
Source: C:\Windows\System32\rundll32.exe Code function: 16_2_00000075CE97D5E2 push ecx; retf 16_2_00000075CE97D639
Source: C:\Windows\System32\rundll32.exe Code function: 16_2_00000075CE97E5C2 pushad ; retf 16_2_00000075CE97E65F
Source: C:\Windows\System32\rundll32.exe Code function: 17_2_000000856FBDD7CB push ecx; retf 17_2_000000856FBDD7D9
Source: C:\Windows\System32\rundll32.exe Code function: 17_2_000000856FBDE762 pushad ; retf 17_2_000000856FBDE7FF
Source: C:\Windows\System32\rundll32.exe Code function: 17_2_000000856FBDEE2B push ecx; retf 17_2_000000856FBDEE39
Source: C:\Windows\System32\rundll32.exe Code function: 17_2_000000856FBDECB3 push ecx; retf 17_2_000000856FBDECB9
Source: C:\Windows\System32\rundll32.exe Code function: 17_2_000000856FBDDC1B push ecx; retf 17_2_000000856FBDDC29
Source: C:\Windows\System32\rundll32.exe Code function: 17_2_000000856FBDDAEB push ecx; retf 17_2_000000856FBDDAF9

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Windows\System32\loaddll64.exe Memory written: PID: 3416 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Memory written: PID: 3416 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 2496 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 2496 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 6092 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 6092 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 1416 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 1416 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 7120 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 7120 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 5448 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 5448 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 2188 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 2188 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 6556 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 6556 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 2100 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory written: PID: 2100 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\System32\rundll32.exe RDTSC instruction interceptor: First address: 7FFD9128615B second address: 7FFD91286168 instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 bt ebx, 10h 0x00000007 inc ecx 0x00000008 pop ebx 0x00000009 inc bp 0x0000000b cmp edi, eax 0x0000000d rdtsc
Source: C:\Windows\System32\rundll32.exe RDTSC instruction interceptor: First address: 7FFD912A8D2B second address: 7FFD912A8D96 instructions: 0x00000000 rdtsc 0x00000002 inc esp 0x00000003 movzx ecx, dx 0x00000006 mov eax, dword ptr [esp+00000100h] 0x0000000d mov dword ptr [esp+30h], eax 0x00000011 dec eax 0x00000012 movsx ecx, ax 0x00000015 jmp 00007FD534DB8AE5h 0x0000001a dec eax 0x0000001b mov eax, dword ptr [esp+000000F8h] 0x00000022 inc cx 0x00000024 not ecx 0x00000026 cdq 0x00000027 inc sp 0x00000029 cmovnle eax, eax 0x0000002c dec eax 0x0000002d mov dword ptr [esp+28h], eax 0x00000031 dec ebp 0x00000032 movzx ecx, si 0x00000035 dec eax 0x00000036 mov eax, dword ptr [esp+000000F0h] 0x0000003d jmp 00007FD534DB8AE8h 0x00000042 dec eax 0x00000043 mov dword ptr [esp+20h], eax 0x00000047 movsx ecx, di 0x0000004a movsx cx, dl 0x0000004e dec esp 0x0000004f mov ecx, dword ptr [esp+000000E8h] 0x00000056 inc bp 0x00000058 movsx eax, dl 0x0000005b inc ecx 0x0000005c mov al, 5Eh 0x0000005e cbw 0x00000060 dec esp 0x00000061 mov eax, dword ptr [esp+000000E0h] 0x00000068 rdtsc
Source: C:\Windows\System32\loaddll64.exe RDTSC instruction interceptor: First address: 7FFD9128615B second address: 7FFD91286168 instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 bt ebx, 10h 0x00000007 inc ecx 0x00000008 pop ebx 0x00000009 inc bp 0x0000000b cmp edi, eax 0x0000000d rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DF230 rdtsc 3_3_00000218157DF230
Contains functionality to detect virtual machines (SGDT)
Source: C:\Windows\System32\rundll32.exe Code function: 9_2_00000018F658C38B sgdt fword ptr [eax] 9_2_00000018F658C38B
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\loaddll64.exe TID: 2788 Thread sleep time: -120000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: Amcache.hve.10.dr Binary or memory string: VMware
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.10.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: rundll32.exe, 00000003.00000002.2273858332.0000021813310000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2175147566.000002D6FCCF9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3358098892.000001837E2C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437510358.0000014A16D46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2437465179.0000014A16CDE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2423622751.000001C53D2E6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.2396463551.000001C53D280000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.3357407509.000001D1C77B8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553448464.000002146B546000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2553303212.000002146B4DE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2559893572.000001B229AB6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.10.dr Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\System32\loaddll64.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\System32\rundll32.exe Code function: 3_3_00000218157DF230 rdtsc 3_3_00000218157DF230

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Windows\System32\loaddll64.exe NtUnmapViewOfSection: Direct from: 0x7FFD9317F883 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe NtProtectVirtualMemory: Direct from: 0x7FFD9317F8E7 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe NtMapViewOfSection: Direct from: 0x7FFD9317F8D9 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe NtProtectVirtualMemory: Indirect: 0x7FFD912BA147 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe NtProtectVirtualMemory: Direct from: 0x7FFD9317F924 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Loki.dll.dll",#1 Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.10.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528326 Sample: Loki.dll.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 60 30 PE file contains section with special chars 2->30 32 AI detected suspicious sample 2->32 7 loaddll64.exe 1 2->7         started        process3 signatures4 34 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->34 36 Tries to detect virtualization through RDTSC time measurements 7->36 38 Found direct / indirect Syscall (likely to bypass EDR) 7->38 10 rundll32.exe 7->10         started        13 rundll32.exe 7->13         started        15 cmd.exe 1 7->15         started        17 6 other processes 7->17 process5 signatures6 40 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->40 42 Tries to detect virtualization through RDTSC time measurements 10->42 19 WerFault.exe 23 16 10->19         started        21 WerFault.exe 16 10->21         started        23 WerFault.exe 16 13->23         started        25 WerFault.exe 16 13->25         started        27 rundll32.exe 15->27         started        process7 signatures8 44 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 27->44
⊘No contacted IP infos