Edit tour

Windows Analysis Report
AIDE.dll

Overview

General Information

Sample name:	AIDE.dll
Analysis ID:	1541476
MD5:	88bb7da02bb090f865c572342c3c0707
SHA1:	631444929367bb3a0dcd8bc606c2fb886b301ebd
SHA256:	f65fdf18113f4066bf0edf398ace48a01b181687368d1a29e517138d496b2de0
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

One or more processes crash

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5344 cmdline: loaddll32.exe "C:\Users\user\Desktop\AIDE.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 1776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3132 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 1912 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 1220 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 568 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 2548 cmdline: rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@II@Z MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 3416 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 604 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6728 cmdline: rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@XZ MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 988 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 624 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 1268 cmdline: rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEFormatType@AIDE@@QAE@H@Z MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 5396 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 632 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 3708 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@II@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6596 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@XZ MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3576 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEFormatType@AIDE@@QAE@H@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 716 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWritePrivateChunk MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6068 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetImageQuality MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1016 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetCompressionType MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4600 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetTileSize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1088 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParamsCustomLayers MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 368 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParams MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1112 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCustomEncodeParams MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2324 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCompressionScheme MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5580 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsDiableLayer MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2100 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDERawEncodeOptionsSetBlurMethod MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5660 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPalettizationTechnique MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4460 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPHYChunk MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6548 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetInterlaced MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1816 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetForcedPaletteCreation MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1912 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetFilterType MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2188 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetCompressionLevel MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6108 cmdline: rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetAttemptPaletteCreation MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: AIDE.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: AIDE.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source:

Binary string: AIDE.pdb source: loaddll32.exe, 00000000.00000002.3388762896.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.2195035465.000000006D197000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.2189878555.000000006D197000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2189953587.000000006D197000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2221280907.000000006D197000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2295827128.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2295475339.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2242151164.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2243258186.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2299519975.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2318205841.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2245018148.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2243443995.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2247807589.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2247037175.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2242070295.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2248831521.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2245169688.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2258313899.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2250653537.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2250123188.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.2256345581.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.2248848969.000000006D427000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.2261825532.000000006D427000.00000002.00000001.01000000.00000003.sdmp, AIDE.dll

Source: Amcache.hve.9.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\AppCompat\Programs\Amcache.hve.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 568

Source: AIDE.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: clean4.winDLL@92/20@0/0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1776:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6728
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2548
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1912
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1268

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a012b798-eef4-4e3a-a255-4693fb88f4ae

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@II@Z

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\AIDE.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@II@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 568
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 604
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@XZ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 624
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEFormatType@AIDE@@QAE@H@Z
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 632
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@II@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@XZ
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEFormatType@AIDE@@QAE@H@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWritePrivateChunk
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetImageQuality
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetCompressionType
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetTileSize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParamsCustomLayers
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParams
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCustomEncodeParams
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCompressionScheme
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsDiableLayer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDERawEncodeOptionsSetBlurMethod
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPalettizationTechnique
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPHYChunk
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetInterlaced
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetForcedPaletteCreation
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetCompressionLevel
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetAttemptPaletteCreation
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@II@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEFormatType@AIDE@@QAE@H@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@II@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEFormatType@AIDE@@QAE@H@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWritePrivateChunk	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetImageQuality	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetCompressionType	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetTileSize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParamsCustomLayers	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParams	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCustomEncodeParams	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCompressionScheme	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsDiableLayer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDERawEncodeOptionsSetBlurMethod	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPalettizationTechnique	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPHYChunk	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetInterlaced	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetForcedPaletteCreation	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetCompressionLevel	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetAttemptPaletteCreation	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 632	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 604	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AIDE.dll

Static PE information: More than 195 > 100 exports found

Source: AIDE.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AIDE.dll

Static file information: File size 3224064 > 1048576

Source: AIDE.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x26ba00

Source: AIDE.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AIDE.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AIDE.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AIDE.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AIDE.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AIDE.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AIDE.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: AIDE.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: AIDE.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AIDE.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AIDE.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AIDE.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AIDE.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: AIDE.dll

Static PE information: section name: IPPCODE

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Rundll32	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AIDE.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541476
Start date and time:	2024-10-24 21:44:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AIDE.dll
Detection:	CLEAN
Classification:	clean4.winDLL@92/20@0/0
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 104.208.16.94
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: AIDE.dll

Simulations

Behavior and APIs

Time	Type	Description
15:45:31	API Interceptor	4x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8bc36d909c559b6ea338ed316faee572ae62d6a0_7522e4b5_13970ce5-8fc5-44eb-a970-7b6994934808\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8647734121050142
Encrypted:	false
SSDEEP:	96:ldFkRp6iCLhVypsj94sSdv/fhjQXIDcQvc6QcEVcw3cE/O/a/z+HbHg/BQAS/Yyv:n9iwOpn00BU/wjeT8zuiFQZ24IO8dci
MD5:	FD7BB3FB023700B2B86854EAAC54F559
SHA1:	0ADA8671657B60D21F77217970B4B0CB49C9919B
SHA-256:	3FA9298CEFDAD5D8925AED508CAA5E683919E8078AC87218C0EB215F83105D9E
SHA-512:	200FC2E0BEE957972980A0E3A90335F2350AFE37D95A59067FD01DA9E37D3CCB4BDE27F8E88EF9A15300E2D88CAE89713D2A4EB03E1D2C6A6345FB5317D2CF11
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.7.2.7.2.7.3.1.1.9.2.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.7.2.7.2.8.3.7.4.3.8.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.9.7.0.c.e.5.-.8.f.c.5.-.4.4.e.b.-.a.9.7.0.-.7.b.6.9.9.4.9.3.4.8.0.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.5.d.d.4.b.a.-.b.7.6.6.-.4.7.9.2.-.a.2.b.5.-.1.7.3.3.7.7.7.3.d.e.3.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.f.4.-.0.0.0.1.-.0.0.1.5.-.d.5.8.e.-.f.9.4.5.4.d.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8bc36d909c559b6ea338ed316faee572ae62d6a0_7522e4b5_d9901553-cb92-4cd7-a298-84b8ea445ca5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8646186575800656
Encrypted:	false
SSDEEP:	192:1MBi2Otn00BU/wjeT8zuiFQZ24IO8dci:Gi3tvBU/wjeIzuiFQY4IO8dci
MD5:	D68166B6B9713DCA151016B1BC73F484
SHA1:	333B27657BEBDB4FDFC3E94E947DC615B4CF3EC2
SHA-256:	6CFDD817073D7E25C30971DBF0331C7D28455007A0BEBAAE2ECDB93FB6398185
SHA-512:	AF9A85623A768A35F5FFACD5A27D375AFBDB5547D0422CEE5E4C044F16EA515821619920D7A04CCBD3D1E7DBF19925C0033EAF57370C74259F1A0FD9502E0826
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.7.2.7.2.7.2.9.5.7.0.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.7.2.7.2.8.2.9.5.6.9.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.9.0.1.5.5.3.-.c.b.9.2.-.4.c.d.7.-.a.2.9.8.-.8.4.b.8.e.a.4.4.5.c.a.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.5.7.a.1.0.a.-.9.6.8.f.-.4.3.a.2.-.9.b.e.e.-.0.c.3.0.0.5.c.7.3.0.d.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.7.8.-.0.0.0.1.-.0.0.1.5.-.4.0.7.a.-.f.b.4.5.4.d.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c42f13f4915a1555add63cb2a13088f4185d657b_7522e4b5_f8213d4f-3c7c-4f65-bd90-7e201c868190\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8645173483587538
Encrypted:	false
SSDEEP:	192:Lr5i0OdOnA0BU/wjeTEzuiFQZ24IO8dci:BiFkbBU/wjeQzuiFQY4IO8dci
MD5:	D754EA6D7E971B71C38FBE2F0DF03F19
SHA1:	332CC8F7C297B7A5500DA9C026038EAD195B0533
SHA-256:	3703C4F7A6806A16B1FE674CC1A694EF6A24B56C8E87EB20C0F60B2B97048B64
SHA-512:	682CD1CFEE24D2A684C20B7FDBE36537AFFDAAD743EE57644A1A541124BF62FB89FE17C8FB1D8629EBA256CAF5E9ABD6909108CD8FB59E563BA7C357A3993F84
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.7.2.7.2.9.9.3.0.1.3.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.7.2.7.3.0.3.2.0.7.5.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.2.1.3.d.4.f.-.3.c.7.c.-.4.f.6.5.-.b.d.9.0.-.7.e.2.0.1.c.8.6.8.1.9.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.8.2.b.4.3.e.8.-.2.e.2.f.-.4.f.6.d.-.b.7.6.f.-.1.f.0.3.7.7.b.8.2.6.2.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.4.8.-.0.0.0.1.-.0.0.1.5.-.5.1.f.5.-.c.6.4.7.4.d.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c8996f612b49173415ae526f81d4acc39bc15c_7522e4b5_16e32c9f-8e31-43f7-b680-d5906805550a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8646047505851667
Encrypted:	false
SSDEEP:	96:G1Fs6iphVy+sj94sSdv/fh+QXIDcQvc6QcEVcw3cE/O/a/z+HbHg/BQAS/YyNl4O:afipO+nR0BU/wjeTMzuiFQZ24IO8dci
MD5:	62A44A5E7E7D869BED070E0EEF1F705E
SHA1:	119832442C90D09BC7BA650100BC76B1486F8D33
SHA-256:	EE0BF3D8BC221AFF58C2E906D847BB9B7B06AB7EB2FFF43F7467A1A56218EDB5
SHA-512:	42A2B293CE544B35C9F957C67BA2966E40EE6526C851DA60512B3E33FF91E0D39B54FB9C58D78AD6CEDA6A7CDFF4E2ACA013ECFDA62E4FB21CA03612213491EE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.7.2.7.3.2.9.4.1.8.9.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.7.2.7.3.3.2.7.0.0.2.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.6.e.3.2.c.9.f.-.8.e.3.1.-.4.3.f.7.-.b.6.8.0.-.d.5.9.0.6.8.0.5.5.5.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.2.7.1.5.e.e.-.1.2.9.b.-.4.4.7.7.-.a.a.9.3.-.3.6.1.f.5.5.5.d.2.2.d.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.f.4.-.0.0.0.1.-.0.0.1.5.-.a.b.1.c.-.9.3.4.9.4.d.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE504.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 24 19:45:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42934
Entropy (8bit):	1.9467745749728307
Encrypted:	false
SSDEEP:	96:568ERESAYXgjiYFZob8Ykxm6TSE2goEloi75I4v46geqrlNLHnbaGA2y3+BH2rKC:HERyR/pctESO5H4wP+y3KPJa+fuFuLy
MD5:	AE0E384FCE614C64D5C1E8EA674717D4
SHA1:	8D3277BAA2E5CFC11475F14D4830B921E87C991E
SHA-256:	8139116D528C9D97D1A5C65C71006BC904E22D666E91CF5F68B71BEDEBD4AFBD
SHA-512:	95C93075350F77C1579023E06C6ABC9B08C92509BAA089A0D71C8F0FDB2CE742137C823B343A4DF2EF0BEE2A6C279F13B3612223B1A7058BE34F74B70A455E0A
Malicious:	false
Preview:	MDMP..a..... .........g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T.............g.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE514.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 24 19:45:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	51130
Entropy (8bit):	1.8109183029570783
Encrypted:	false
SSDEEP:	192:H4d46WCaAjO5H4adggN++SXDAfCGygQUTT:YNa5HC+SMfC7UT
MD5:	82B4C26AA5E2194534132859C5C253AB
SHA1:	48C41BFE18FE3E98CC4A4CAE19266832A98AD8AE
SHA-256:	EB2D3522460F2752AB5F070BCA4C53490431203AB13157894BB49DD04DF656CB
SHA-512:	88316528B3C68A54EBD467693E3CF3F3E174B2D59DA30AC7CAAC8A8A1BA9F53C4FD21025C176125E5A979CE5DA25C88F4639F27112A1BA8B25ED83D50459EF46
Malicious:	false
Preview:	MDMP..a..... .........g.........................................,..........T.......8...........T...........8...........................................................................................................eJ......\.......GenuineIntel............T.......x.....g.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5F0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8258
Entropy (8bit):	3.693665793837194
Encrypted:	false
SSDEEP:	192:R6l7wVeJeR6IVw6Y0L6pwgmfTpqHprA89btDsftvm:R6lXJw6IVw6YY6pwgmfTAntofo
MD5:	D3B0833D0133058FE583049320DD1670
SHA1:	3AD12EE76ADCF62FF27A5F179EE90B371B6337E8
SHA-256:	C10BC64493A8488512BD12776D74FA47E9445695131B393F348E2F28F9B2858F
SHA-512:	1AE57FB12117BD3B81EFE63FD1065C4F71A761528C272B52FF75C36ED2EFC37C5CB0D14BDC02FDB7191CC1F0B675CBEE93763AA4227FD9C745DA12308B46E9C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE60F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8254
Entropy (8bit):	3.6922455225976463
Encrypted:	false
SSDEEP:	192:R6l7wVeJeju6Ie76Y4D66lgmfTpqHprp89bt6sfFLvm:R6lXJwu6Ie76Yy66lgmfTA8tZf0
MD5:	A183EDC9641956BE151A4F96C701DACE
SHA1:	297D5B017128B7FCEA75F65EB1DEC547333FE8DD
SHA-256:	47BC9CC5B2C3F69BF58F2AC15EF0D5BFC670171508CD3635A921C30C17F8F467
SHA-512:	C5488679F93DFB92B5AD0912642E701EAE3A5CF9748ABA658E8C52BC066FC5F5D9E4B6E358073EDE3F5412A64B642E5C562F7715A35D8401FEE6BA5532F7B7F2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE63F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4646
Entropy (8bit):	4.46805298872925
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI974WpW8VYXbYm8M4JCdPxZFHKj+q8/ku10GScS1d:uIjfsI7hx7VW+Jvj20J31d
MD5:	36EFB9A88A2B1E6E33DA299CA899F2FF
SHA1:	4C902AF9ED04460688275E58A15781D8B758A983
SHA-256:	D5A23D9CAA503D9A610A60EF4CAE3B8AF2E120F3AB980E39D6F728F1FCE2EFDE
SHA-512:	DCE10646BD7E8EB169440B02486DD6C85FCAA591CD880B010C53E6D3DD149B96F3DE23334F5A81FEB6856D40839DAF26C522962CC77067F2182B527BFC1EBD9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557928" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE64F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4646
Entropy (8bit):	4.465705968758028
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI974WpW8VYXZYm8M4JCdPxZF4yj+q8/kuX0GScSid:uIjfsI7hx7VWIJUk0J3id
MD5:	BD5DB1A2530D1A07C55392ADF0E7A309
SHA1:	F33BDCB72855F91716590D42AEAC72422CE7177C
SHA-256:	964E1733D2CFD4C049813E25F148A3DEC087EECD07935E1D2F8580B9E2CAF13B
SHA-512:	B5BA8598E90B5224078A2BD09F459489737F7EAB933D76786E5BD73F1F94643E642FE5EB640C45A00A2B4687C24AC7670E3FE45AFCA84D63455B9390EB3F4023
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557928" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF45.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 24 19:45:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41690
Entropy (8bit):	2.0158317933178034
Encrypted:	false
SSDEEP:	192:GEi49R/f9PO5H4wfDpHOJmQSU7NiASRQpIuZ:5s5HBDpu3SY
MD5:	EF2A7EAF2736DE813765B11AD1EE613B
SHA1:	AE673772E685E99E52D362C857D3F7371C7FC05E
SHA-256:	989FEEF90C27E15CFC14CF577CF352E684A830803D89064FABD91B95412162EF
SHA-512:	AAC8DE23BBEDF89B0759D11CF44DBA9A7EE145BD82044373865AD2AD0B1712F93684D235EEE18FFCC125D55D84C97F34AEB4B11F139DD61E3E6C93834E6172CB
Malicious:	false
Preview:	MDMP..a..... .........g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T.......H.....g.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFA4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8258
Entropy (8bit):	3.6939129664666135
Encrypted:	false
SSDEEP:	192:R6l7wVeJudl6Ic26Y0A6PBgmfTpuHprG89bjysfdBm:R6lXJG6Ic26Yj6ZgmfT81jxfy
MD5:	B6AA90C11F96355F2B43D1B229CE9D55
SHA1:	1B43C8BC10954DE6E78614217E41277EA04B94C2
SHA-256:	4EEBBB2226012B359B3794F2F8963BB06DA802BD6AC3DD0455D593862CACBB46
SHA-512:	6045076C6151E9D9C37533BD0742DF204CFBB3FF47BAB5021997A5E3EFCF830224284FFE6B8057A12F13B92EBF0C15B1B0A98A339F710A41AA1B7CDB38130E44
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFD4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4646
Entropy (8bit):	4.4684479616876525
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI974WpW8VYXXvYm8M4JCdPLFi+q8/kDy0GScSkd:uIjfsI7hx7VWXyJDK0J3kd
MD5:	B6B438E459D6C7799D850316E17389E1
SHA1:	483F81E6C33FFAE13AB6884041F739518F59A27E
SHA-256:	52ABEAB91976BDA3C964D440D01942BA7576E79E3EC58DD3F19E4BC2DC279786
SHA-512:	CCC263F4E29FF705A17A10C8D09BE879421FADB734C992447589E5909D1215A2D4FFF93DCA7E60D5EF0AE510CFBBD21DB98CF377F3E87425954B5EA19692EAD2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557928" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB0D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 24 19:45:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43986
Entropy (8bit):	1.8970553399312238
Encrypted:	false
SSDEEP:	96:5k8EICNBmYXgjiYFZob8Yoxmn3E7MQwbNJoi75I4v4qii0BRBHkrKVkjS68LWx4H:JEICCR/VdMdcO5H4psbiiLsyotTqFu
MD5:	1F813034B79E3D946DCA229FE74BDAB3
SHA1:	0C47D9A36B4123FE5DA285B500A527340B2C54D5
SHA-256:	6B610A337E74B3B6AEAAB5D4F4F2FCCA7B91F5C8E789937957688A6F40625869
SHA-512:	F18235B66E716E94DCB8057CBAF14D8DE35735425EF802F80C33DBBFCB62601325509F4C21D6F24131F6A0C95C088EDE507CA67438D0D049B826AF1529A686AF
Malicious:	false
Preview:	MDMP..a..... .........g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T.............g.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB8B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8258
Entropy (8bit):	3.6919559627820484
Encrypted:	false
SSDEEP:	192:R6l7wVeJgP6IcOl6Y0K6hgmfTpRHprG89bo9sfTYm:R6lXJQ6Ic06Y56hgmfTv1o2fp
MD5:	07A3173255FF8A0110358D05BABE6215
SHA1:	9F68094D53C8E9B30DC8B25F07282BDC0EA2E9B4
SHA-256:	019A734F4D29C40D160037E700C845D1D66EE322D2BF12B477931A6D55DACFEC
SHA-512:	AE9DB5B1C05064334D2248F2C88E2D942C929D93D7CE3F66DADD40F11898B75EAAA13F32A9314691C324DE6CABB6930A3ED3551815E3A29D3A07393F82D818A1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBBB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4646
Entropy (8bit):	4.467623285387864
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI974WpW8VYXJYm8M4JCdP6Fr0+q8/kK10GScShd:uIjfsI7hx7VWYJM80J3hd
MD5:	8BA9B84E1E97EEB65CF20A461CF07823
SHA1:	78A21C6BD4DCBA7F1005BF23B96BA0E87D23EF5F
SHA-256:	ADFFFB4317173351050795595BC9E310F388C2D70374734AF712983BE3E2B9C3
SHA-512:	E0646D933760CDB648885E77A668D576732B4FA10A01B665F5068801A9CF5F6AA8BCF8EEB8EFFDA2D04660AE4F4E9806B01A562BF8683B89B397E812353D2F46
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557928" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469168066701271
Encrypted:	false
SSDEEP:	6144:HzZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNLjDH5S:TZHtYZWOKnMM6bFppj4
MD5:	02FB53D5F03DC3CA752D80F8153988A4
SHA1:	50737BB481CCA75ACC775E829B399ABC26B04F38
SHA-256:	0111D5662E7742F8A69656C15EB4502F6B6A915479FA00A937B786A4FD890F71
SHA-512:	A1FD9D18C637DC4441AAAF44AB52313029BE47DB798649C5BEAFB2EDA07BD60BA23A961098F800E4AFB4698B1DA87C0C812B4195AF196B8FFFDB5D8DBDECB939
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.`IFM&...............................................................................................................................................................................................................................................................................................................................................,_r........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.tmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.075277690065852
Encrypted:	false
SSDEEP:	48:YrHV6eEr0bfkoxpqGZqS3eXFPjrjlApl7VplUplEAl17NgJl5XJAPknHmO:YroeEIrkQqGZuXZALxLULEvz9n5
MD5:	6A5CBF9F612EE5669CC1A7A6C07AFB9F
SHA1:	C4846325D9E0661B06B21A47CDA74D3474A8CAF3
SHA-256:	4A8D8F2AC42CCFE7A3712B63316EB06C6FD50EAA9D8AE626894CCD189785FAB4
SHA-512:	1FA65ACCA8F2206205CD9C5FFFE6C52CAA9652714AF4B85A977AEE8074514B95623C6E3D5536CF08F69B7C97FF5FACFADFBC1669BCA14D3CEC57D8B6C77BA46F
Malicious:	false
Preview:	regf........`.PFM&.................. ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...Z...Jc...-...-$.Z...Jc...-...-$.....[...Jc...-...-$.rmtm..RFM&..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.10899319099567
Encrypted:	false
SSDEEP:	48:ItHVbQeEr0bfkoxpqGZqS3eXFPjrjlApl7VplUplEAl17NgJl5XJAPknHmO:It9QeEIrkQqGZuXZALxLULEvz9n5
MD5:	DCF1110E76D0933FCD24B7435FDA33EB
SHA1:	CB9DB53026F6F4FC1B9B473FCAF437D3771F67C8
SHA-256:	F5B393783F454F27C26576382F64DC507CCC759B7DE9FE9D8C9BC9B4F8640B93
SHA-512:	350462C37442C50E60DC8A3C18078206B886FC030E26B9D6618F725AA7D6C78BCBB2E82DD8952E6163EF36F8498DC69BBFBDB5644749CDD8F28DBE6608D6FF0D
Malicious:	false
Preview:	regf........`.PFM&.................. ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...Z...Jc...-...-$.Z...Jc...-...-$.....[...Jc...-...-$.rmtm..RFM&..................................................................................................................................................................................................................................................................................................................................................HvLE....................K.(.P.... ...2.........hbin................`.PFM&..........nk,...RFM&...... .......................8.......................f.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk......................\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..f...`.........(.CreatingCommando....C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.W.e.r.F.a.u.l.t...e.x.e. .-.u. .-.p. .1.9.1.

C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG2

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.0284110781435225
Encrypted:	false
SSDEEP:	48:ItHVhgbeEr0bffxpq3SWS3eXFPjrjlApl7VplUplEAl17NgJl5XJAPkJHO:It/4eEIrPqizuXZALxLULEvz9Ju
MD5:	C0A468CD245E58C6C496CD30B2581E7F
SHA1:	27164CA564DEA37EDC5CBA1AB2BA097771D58042
SHA-256:	2AF19551C47BD1406C337BDCABD1582691940209BA681A4C79323A99C3F8B1E4
SHA-512:	3973B257EF555F839144CC7D7E62E355F4B88522C51023F762BF7735681828A99E49CA1089A7FEEBB03587CFF3927E3C0653A62DAAFD205CB76F4AFADA5F4376
Malicious:	false
Preview:	regf........`.PFM&.................. ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...Z...Jc...-...-$.Z...Jc...-...-$.....[...Jc...-...-$.rmtm..RFM&..................................................................................................................................................................................................................................................................................................................................................HvLE....................6..Y.w....8..'........hbin................`.PFM&..........nk,...RFM&..............................8.......................f.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk......................\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..f...`.........(.CreatingCommando....C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.W.e.r.F.a.u.l.t...e.x.e. .-.u. .-.p. .1.9.1.

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.64334674740505
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AIDE.dll
File size:	3'224'064 bytes
MD5:	88bb7da02bb090f865c572342c3c0707
SHA1:	631444929367bb3a0dcd8bc606c2fb886b301ebd
SHA256:	f65fdf18113f4066bf0edf398ace48a01b181687368d1a29e517138d496b2de0
SHA512:	2425b5438e1edb47ba77c130522c36ac1a3b9be03f14418d2217aa209be13c5d811a28238eded3e56c7aaa30ce56f85c73959ec1286334a135b011eb2951db55
SSDEEP:	49152:hr2dsUtswYLENDuee1os5iUwYg84HHtGeQ1+704nHITg:EbMee1os5m84HHqKF
TLSH:	3AE58C40E6D3A165E1AA05B0907FAB6AAD3C2B241318C5F7D3C4ED7878317C27672B97
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........ur..............l.......l.......l.......l.......l.......l..........^...................um......................um..4...um.....

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10266db0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x63F0C9E2 [Sat Feb 18 12:51:46 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8ee2afb2a634d81da6694cec5013d213

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F25D4649147h
call 00007F25D46493A8h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F25D4648FF3h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F25D4647D94h
pop ecx
pop ebp
ret
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 102E3FC4h
mov dword ptr [ecx], 10299438h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F25D464911Fh
push 102F956Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F25D4649482h
int3
jmp 00007F25D46494F8h
int3
int3
int3
int3
int3
push 10266E70h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [10303304h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, dword ptr [ebp+08h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2f9590	0x2164	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2fb6f4	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x314000	0x6e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x315000	0x1001c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2eef80	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2ef000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2eeec0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x297000	0x250	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x26b94b	0x26ba00	7c78a4ae4f0b99c76b0de592c53a9e56	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
IPPCODE	0x26d000	0x29375	0x29400	301bd2a4c4023e7b8ef4d2800d3f5ad5	False	0.11089015151515151	data	6.193681267415867	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x297000	0x65a04	0x65c00	160d3d5ad86e11a1b1da464513c27649	False	0.24074785012285013	data	5.065979306424012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2fd000	0x16e1c	0x7a00	b215ed69325c4a9c5046198f49dce453	False	0.26005379098360654	data	4.544523456831283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x314000	0x6e0	0x800	13b09b33b96fb2af0721bbe31f712d6f	False	0.39208984375	data	3.7054302229261653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x315000	0x1001c	0x10200	00f8b6c67ed2e29d40205eb3f6e3ba53	False	0.7304384689922481	data	6.710450687816106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3140a0	0x4c0	data	English	United States	0.44161184210526316
RT_MANIFEST	0x314560	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WindowsCodecs.dll	WICConvertBitmapSource
KERNEL32.dll	InitializeSListHead, DisableThreadLibraryCalls, CloseHandle, WaitForSingleObject, CreateThread, GetSystemInfo, ReleaseSemaphore, CreateSemaphoreA, FreeLibrary, GetProcAddress, LoadLibraryA, IsProcessorFeaturePresent, GetTempPathA, DeleteFileA, GetTempFileNameA, LeaveCriticalSection, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, EnterCriticalSection
ole32.dll	CoInitializeEx, PropVariantClear, CoCreateInstance
MSVCP140.dll	??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z, ?_Xlength_error@std@@YAXPBD@Z, ?uncaught_exception@std@@YA_NXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
VCRUNTIME140.dll	__current_exception, __current_exception_context, _except_handler4_common, __std_type_info_destroy_list, strstr, strrchr, _setjmp3, __CxxLongjmpUnwind, longjmp, memchr, memset, memmove, __CxxFrameHandler3, _CxxThrowException, __std_exception_destroy, __std_exception_copy, __std_terminate, _purecall, memcpy
api-ms-win-crt-runtime-l1-1-0.dll	_initterm_e, _wassert, _invalid_parameter_noinfo_noreturn, exit, _initterm, _cexit, abort, _initialize_narrow_environment, terminate, _seh_filter_dll, _configure_narrow_argv, _crt_atexit, _initialize_onexit_table, _register_onexit_function, _execute_onexit_table
api-ms-win-crt-math-l1-1-0.dll	_libm_sse2_log_precise, floor, _libm_sse2_exp_precise, frexp, _CIatan2, _libm_sse2_log10_precise, _libm_sse2_pow_precise, ceil, _libm_sse2_sqrt_precise, ldexp
api-ms-win-crt-heap-l1-1-0.dll	calloc, free, _callnewh, realloc, _aligned_free, _aligned_malloc, malloc
api-ms-win-crt-stdio-l1-1-0.dll	feof, fopen_s, fseek, __acrt_iob_func, fwrite, fflush, fread, fclose, __stdio_common_vsnprintf_s, __stdio_common_vsprintf, __stdio_common_vfprintf, ftell
api-ms-win-crt-utility-l1-1-0.dll	bsearch, rand, srand, qsort
api-ms-win-crt-convert-l1-1-0.dll	atoi
api-ms-win-crt-environment-l1-1-0.dll	getenv
api-ms-win-crt-string-l1-1-0.dll	strncmp, tolower

Exports

Name	Ordinal	Address
??0AIDEDimension@AIDE@@QAE@II@Z	1	0x1010df50
??0AIDEDimension@AIDE@@QAE@XZ	2	0x1010df70
??0AIDEFormatType@AIDE@@QAE@H@Z	3	0x1010df80
??0AIDEFormatType@AIDE@@QAE@XZ	4	0x1010df90
??0AIDEInputOutputStreamCallBacks@AIDE@@QAE@XZ	5	0x1010dfa0
??0AIDEInputStreamCallBacks@AIDE@@QAE@XZ	6	0x1010dfc0
??0AIDELibInitCallBacks@AIDE@@QAE@XZ	7	0x1010dfe0
??0AIDEOutputStreamCallBacks@AIDE@@QAE@XZ	8	0x1010df90
??0AIDEPoint@AIDE@@QAE@II@Z	9	0x1010df50
??0AIDEPoint@AIDE@@QAE@XZ	10	0x1010df70
??0AIDEProgressCallback@AIDE@@QAE@XZ	11	0x1010df90
??0ComponentInfo@AIDE@@QAE@IW4AIDEComponentType@1@@Z	12	0x1010df50
??0ComponentInfo@AIDE@@QAE@XZ	13	0x1010df70
??0PaletteInfo@AIDE@@QAE@XZ	14	0x1010e010
??0PixelPartInfo@AIDE@@QAE@XZ	15	0x100f98b0
??1AIDEDimension@AIDE@@QAE@XZ	16	0x100f9b30
??1AIDEFormatType@AIDE@@QAE@XZ	17	0x100f9b30
??1AIDEInputOutputStreamCallBacks@AIDE@@QAE@XZ	18	0x100f9b30
??1AIDEInputStreamCallBacks@AIDE@@QAE@XZ	19	0x100f9b30
??1AIDELibInitCallBacks@AIDE@@QAE@XZ	20	0x100f9b30
??1AIDEOutputStreamCallBacks@AIDE@@QAE@XZ	21	0x100f9b30
??1AIDEPoint@AIDE@@QAE@XZ	22	0x100f9b30
??1AIDEProgressCallback@AIDE@@QAE@XZ	23	0x100f9b30
??1ComponentInfo@AIDE@@QAE@XZ	24	0x100f9b30
??1PaletteInfo@AIDE@@QAE@XZ	25	0x100f9b30
??1PixelPartInfo@AIDE@@QAE@XZ	26	0x100f9b30
??4AIDEDimension@AIDE@@QAEAAU01@ABU01@@Z	27	0x100f9b50
??4AIDEFormatType@AIDE@@QAEAAU01@ABU01@@Z	28	0x100f9b70
??4AIDEInputOutputStreamCallBacks@AIDE@@QAEAAU01@ABU01@@Z	29	0x100f9b80
??4AIDEInputStreamCallBacks@AIDE@@QAEAAU01@ABU01@@Z	30	0x100f9ba0
??4AIDELayerSize@AIDE@@QAEAAU01@ABU01@@Z	31	0x100f9b50
??4AIDELibInitCallBacks@AIDE@@QAEAAU01@ABU01@@Z	32	0x100f9b80
??4AIDEOutputStreamCallBacks@AIDE@@QAEAAU01@ABU01@@Z	33	0x100f9b70
??4AIDEPoint@AIDE@@QAEAAU01@ABU01@@Z	34	0x100f9b50
??4AIDEProgressCallback@AIDE@@QAEAAU01@ABU01@@Z	35	0x100f9b70
??4ComponentInfo@AIDE@@QAEAAU01@ABU01@@Z	36	0x100f9b50
??4PaletteInfo@AIDE@@QAEAAU01@ABU01@@Z	37	0x100f9bc0
??4PixelPartInfo@AIDE@@QAEAAU01@ABU01@@Z	38	0x100f9be0
?AIDEDecodeOptionsSetComponentOrder@@YA?AW4AIDEError@AIDE@@PAVDecodeOptions@Impl@2@W4AIDEComponentOrder@2@I@Z	39	0x10106a70
?mVersion@AIDEInputOutputStreamCallBacks@AIDE@@2IB	40	0x10299410
?mVersion@AIDEInputStreamCallBacks@AIDE@@2IB	41	0x10299404
?mVersion@AIDELibInitCallBacks@AIDE@@2IB	42	0x10299400
?mVersion@AIDEOutputStreamCallBacks@AIDE@@2IB	43	0x1029940c
?mVersion@AIDEProgressCallback@AIDE@@2IB	44	0x10299408
AIDECreateLibInstance	45	0x10106b40
AIDEDecodeOptionsSetBitDepth	46	0x10106ca0
AIDEDecodeOptionsSetColorSpace	47	0x10106d70
AIDEDecodeOptionsSetDirectDecode	48	0x10106e40
AIDEDecodeOptionsSetImageOrientation	49	0x10106f10
AIDEDecodeOptionsSetImageResampling	50	0x10106fe0
AIDEDecodeOptionsSetIntValue	51	0x101070e0
AIDEDecodeOptionsSetMaxDimensions	52	0x101071e0
AIDEDecodeOptionsSetNoDecodeErrors	53	0x101072e0
AIDEDecodeOptionsSetPackingType	54	0x101073b0
AIDEDecodeOptionsSetPalette	55	0x10107480
AIDEDecodeOptionsSetPrivateChunkNames	56	0x10107550
AIDEDecodeOptionsSetTransparency	57	0x10107620
AIDEDecoderDecodeNextImage	58	0x101076f0
AIDEDecoderDecodeNextTile	59	0x10107730
AIDEDecoderFillPixelPartBuffers	60	0x10107770
AIDEDecoderGetColorInfo	61	0x10107880
AIDEDecoderGetColorSpace	62	0x10107970
AIDEDecoderGetCommonColorBitDepth	63	0x10107a60
AIDEDecoderGetComponentCount	64	0x10107b50
AIDEDecoderGetComponentInfo	65	0x10107c40
AIDEDecoderGetDirectDecode	66	0x10107d80
AIDEDecoderGetEXIF_1_Data	67	0x10107dc0
AIDEDecoderGetEXIF_3_Data	68	0x10107e00
AIDEDecoderGetFormatType	69	0x10107e40
AIDEDecoderGetGlobalTransparencyIndex	70	0x10107e90
AIDEDecoderGetICCProfile	71	0x10107ec0
AIDEDecoderGetIPTCData	72	0x10107f00
AIDEDecoderGetImageResolution	73	0x10107f50
AIDEDecoderGetImageSize	74	0x10108030
AIDEDecoderGetMetaDataBlob	75	0x10108130
AIDEDecoderGetMetaDataBlobAtIndex	76	0x10108180
AIDEDecoderGetMetaDataBlobClientBuffer	77	0x101081e0
AIDEDecoderGetMetaDataIntegerValue	78	0x10108230
AIDEDecoderGetPackingInfo	79	0x10108280
AIDEDecoderGetPaletteColorInfo	80	0x10108380
AIDEDecoderGetPaletteFullyTransparentValue	81	0x10108470
AIDEDecoderGetPaletteInfo	82	0x10108550
AIDEDecoderGetPaletteTransparencyType	83	0x101086f0
AIDEDecoderGetPixelPartInfo	84	0x10108730
AIDEDecoderGetPixelPartInfoBigFilesSupported	85	0x101087b0
AIDEDecoderGetTileInfo	86	0x10108920
AIDEDecoderGetTransparencyType	87	0x101089c0
AIDEDecoderGetXMPData	88	0x10108a00
AIDEDecoderHasPalettedComponent	89	0x10108a40
AIDEDecoderSetMaxTileBufferSize	90	0x10108b30
AIDEDecoderSetMaxTileBufferSizeBigFilesSupported	91	0x10108b70
AIDEDestroyLibInstance	92	0x10108bb0
AIDEEncoderEncodeNRows	93	0x10108bd0
AIDEEncoderEncodeNextImage	94	0x10108d40
AIDEEncoderFinishEncoding	95	0x10108e20
AIDEEncoderGetFormatType	96	0x10108fb0
AIDEEncoderRegisterProgressCallback	97	0x101090a0
AIDEEncoderSetColorSpace	98	0x101091b0
AIDEEncoderSetCommonColorBitDepth	99	0x10109290
AIDEEncoderSetEXIF_1_Data	100	0x10109370
AIDEEncoderSetEXIF_3_Data	101	0x10109460
AIDEEncoderSetICCProfile	102	0x10109550
AIDEEncoderSetIPTCData	103	0x10109640
AIDEEncoderSetImageResampling	104	0x10109730
AIDEEncoderSetImageResolution	105	0x10109830
AIDEEncoderSetImageSize	106	0x10109920
AIDEEncoderSetMetaDataBlob	107	0x10109a20
AIDEEncoderSetMetaDataIntegerValue	108	0x10109b00
AIDEEncoderSetPaletteFullyTransparentIndex	109	0x10109be0
AIDEEncoderSetPaletteInfo	110	0x10109cc0
AIDEEncoderSetPaletteTransparencyType	111	0x10109e10
AIDEEncoderSetPixelPartInfo	112	0x10109ef0
AIDEEncoderSetPixelPartInfoBigFilesSupported	113	0x10109f20
AIDEEncoderSetTileInfo	114	0x1010a040
AIDEEncoderSetTransparencyType	115	0x1010a1b0
AIDEEncoderSetXMPData	116	0x1010a290
AIDEEncoderWriteHeader	117	0x1010a380
AIDEEncoderWritePixelPartBuffers	118	0x1010a4e0
AIDEJXREncodeOptionsSetAlphaChannelFormat	119	0x1010a5e0
AIDEJXREncodeOptionsSetAlphaChannelQuality	120	0x1010a6b0
AIDEJXREncodeOptionsSetBitStreamOrdering	121	0x1010a780
AIDEJXREncodeOptionsSetChromaSubSampling	122	0x101073b0
AIDEJXREncodeOptionsSetCompressionType	123	0x1010a850
AIDEJXREncodeOptionsSetImageQuality	124	0x1010a920
AIDEJXREncodeOptionsSetOverlapLevel	125	0x1010a9f0
AIDEJXREncodeOptionsSetTilingSlices	126	0x1010aac0
AIDEJpegEncodeOptionsSetAIQuality	127	0x1010ab90
AIDEJpegEncodeOptionsSetCustomQuality	128	0x1010ac60
AIDEJpegEncodeOptionsSetEncodeMethod	129	0x1010ad30
AIDEJpegEncodeOptionsSetEncodeMode	130	0x1010ae00
AIDEJpegEncodeOptionsSetPackingType	131	0x1010aed0
AIDEJpegEncodeOptionsSetQualityLevel	132	0x1010af60
AIDEJpegEncodeOptionsSetSave4WebQuality	133	0x1010b030
AIDEJpegEncodeOptionsSetUseClipping	134	0x1010b100
AIDELibBuildDate	135	0x1010b1d0
AIDELibCreateBmpEncodeOptions	136	0x1010b1e0
AIDELibCreateDecodeOptions	137	0x1010b2b0
AIDELibCreateDecoder	138	0x1010b380
AIDELibCreateDecoderForFormatType	139	0x1010b490
AIDELibCreateEncoderForBMP	140	0x1010b920
AIDELibCreateEncoderForGIF	141	0x1010ba50
AIDELibCreateEncoderForICON	142	0x1010bb80
AIDELibCreateEncoderForJPEG	143	0x1010bcb0
AIDELibCreateEncoderForJXR	144	0x1010bde0
AIDELibCreateEncoderForPDF	145	0x1010bf10
AIDELibCreateEncoderForPNG	146	0x1010c040
AIDELibCreateEncoderForRAW	147	0x1010c170
AIDELibCreateEncoderForTIFF	148	0x1010c2a0
AIDELibCreateEncoderForWEBP	149	0x1010c3d0
AIDELibCreateGifEncodeOptions	150	0x1010c500
AIDELibCreateIconEncodeOptions	151	0x1010b1e0
AIDELibCreateInputOutputStream	152	0x1010c5d0
AIDELibCreateInputStream	153	0x1010c6e0
AIDELibCreateInputStreamUncached	154	0x1010c800
AIDELibCreateJXREncodeOptions	155	0x1010c920
AIDELibCreateJpegEncodeOptions	156	0x1010c9f0
AIDELibCreateOutputStream	157	0x1010cac0
AIDELibCreatePdfEncodeOptions	158	0x1010b1e0
AIDELibCreatePngEncodeOptions	159	0x1010cbc0
AIDELibCreateRawEncodeOptions	160	0x1010cc90
AIDELibCreateTiffEncodeOptions	161	0x1010cd60
AIDELibCreateWebPEncodeOptions	162	0x1010ce30
AIDELibDestroyBmpEncodeOptions	163	0x1010cf00
AIDELibDestroyDecodeOptions	164	0x1010cf20
AIDELibDestroyDecoder	165	0x1010cf40
AIDELibDestroyEncoder	166	0x1010cf40
AIDELibDestroyGifEncodeOptions	167	0x1010cf70
AIDELibDestroyIconEncodeOptions	168	0x1010cf00
AIDELibDestroyInputOutputStream	169	0x1010cf90
AIDELibDestroyInputStream	170	0x1010cfb0
AIDELibDestroyJXREncodeOptions	171	0x1010cfd0
AIDELibDestroyJpegEncodeOptions	172	0x1010cf00
AIDELibDestroyOutputStream	173	0x1010cff0
AIDELibDestroyPdfEncodeOptions	174	0x1010cf00
AIDELibDestroyPngEncodeOptions	175	0x1010cf00
AIDELibDestroyRawEncodeOptions	176	0x1010cf00
AIDELibDestroyTiffEncodeOptions	177	0x1010d010
AIDELibDestroyWebPEncodeOptions	178	0x1010cf00
AIDELibVersion	179	0x1010d030
AIDEPngEncodeOptionsSetAttemptPaletteCreation	180	0x1010d090
AIDEPngEncodeOptionsSetCompressionLevel	181	0x10106ca0
AIDEPngEncodeOptionsSetFilterType	182	0x1010d160
AIDEPngEncodeOptionsSetForcedPaletteCreation	183	0x1010d230
AIDEPngEncodeOptionsSetInterlaced	184	0x10107480
AIDEPngEncodeOptionsSetPHYChunk	185	0x1010d300
AIDEPngEncodeOptionsSetPalettizationTechnique	186	0x1010d3d0
AIDERawEncodeOptionsSetBlurMethod	187	0x1010d4a0
AIDETiffEncodeOptionsDiableLayer	188	0x1010d580
AIDETiffEncodeOptionsSetCompressionScheme	189	0x1010d650
AIDETiffEncodeOptionsSetCustomEncodeParams	190	0x1010d720
AIDETiffEncodeOptionsSetPyramidParams	191	0x1010d7f0
AIDETiffEncodeOptionsSetPyramidParamsCustomLayers	192	0x1010d8f0
AIDETiffEncodeOptionsSetTileSize	193	0x1010d9f0
AIDEWebPEncodeOptionsSetCompressionType	194	0x1010daf0
AIDEWebPEncodeOptionsSetImageQuality	195	0x1010dbc0
AIDEWritePrivateChunk	196	0x1010dc90

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\AIDE.dll"
Imagebase:	0x640000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@II@Z
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",#1
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 568
Imagebase:	0x1a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:45:26
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 604
Imagebase:	0x1a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:45:29
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEDimension@AIDE@@QAE@XZ
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:45:29
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 624
Imagebase:	0x1a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:45:32
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\AIDE.dll,??0AIDEFormatType@AIDE@@QAE@H@Z
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:45:32
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 632
Imagebase:	0x1a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@II@Z
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEDimension@AIDE@@QAE@XZ
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",??0AIDEFormatType@AIDE@@QAE@H@Z
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWritePrivateChunk
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetImageQuality
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEWebPEncodeOptionsSetCompressionType
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetTileSize
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParamsCustomLayers
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetPyramidParams
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCustomEncodeParams
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsSetCompressionScheme
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDETiffEncodeOptionsDiableLayer
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDERawEncodeOptionsSetBlurMethod
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPalettizationTechnique
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetPHYChunk
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:45:35
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetInterlaced
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:45:36
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetForcedPaletteCreation
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	15:45:36
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetFilterType
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:45:36
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetCompressionLevel
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	15:45:36
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AIDE.dll",AIDEPngEncodeOptionsSetAttemptPaletteCreation
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AIDE.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8bc36d909c559b6ea338ed316faee572ae62d6a0_7522e4b5_13970ce5-8fc5-44eb-a970-7b6994934808\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8bc36d909c559b6ea338ed316faee572ae62d6a0_7522e4b5_d9901553-cb92-4cd7-a298-84b8ea445ca5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c42f13f4915a1555add63cb2a13088f4185d657b_7522e4b5_f8213d4f-3c7c-4f65-bd90-7e201c868190\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c8996f612b49173415ae526f81d4acc39bc15c_7522e4b5_16e32c9f-8e31-43f7-b680-d5906805550a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE504.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE514.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5F0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE60F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE63F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE64F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF45.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFA4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFD4.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB0D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB8B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBBB.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.tmp

C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1

C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG2

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
AIDE.dll