Windows Analysis Report
AztyGMg4jw.dll

AV Detection

Source: AztyGMg4jw.dll	ReversingLabs: Detection: 65%
Source: AztyGMg4jw.dll	Virustotal: Detection: 77%			Perma Link

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.5% probability

Cryptography

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D192EF0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,CryptAcquireContextA,___std_exception_copy,		4_2_6D192EF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1934F0 CryptReleaseContext,		4_2_6D1934F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193600 CryptGenRandom,CryptReleaseContext,		4_2_6D193600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1F6F30 CryptReleaseContext,		4_2_6D1F6F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193420 CryptReleaseContext,		4_2_6D193420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193460 CryptGenRandom,		4_2_6D193460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193050 CryptAcquireContextA,GetLastError,CryptReleaseContext,		4_2_6D193050

Compliance

Source: AztyGMg4jw.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\Pfm\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\default_apps\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Extensions\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\MEIPreload\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\WidevineCdm\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\instructions_read_me.txt			Jump to behavior

Source: AztyGMg4jw.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr

Spreading

Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zFM.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zG.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1E571F FindFirstFileExW,		4_2_6D1E571F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D165790 FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,__alldvrm,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Mtx_unlock,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		4_2_6D165790

Networking

Source: rundll32.exe	String found in binary or memory: ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0 *!* To access .onion websites downlo
Source: rundll32.exe	String found in binary or memory: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0*!* To access .onion websites downlo
Source: rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: AztyGMg4jw.dll	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt105.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt148.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt56.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt57.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt133.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt191.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt217.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Source: omni.ja0.3.dr	String found in binary or memory: http://127.0.0.1:
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: icucnv67.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: api-ms-win-crt-utility-l1-1-0.dll.3.dr	String found in binary or memory: http://crl.microsg
Source: pingsender.exe.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: pingsender.exe.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/Do
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: omni.ja0.3.dr	String found in binary or memory: http://dev.w3.org/html5/spec/rendering.html#rendering
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: AppvIsvSubsystems32.dll.3.dr	String found in binary or memory: http://file://sftldr.dllsftldr_wow64.dllIsProcessHookedAppVEntSubsystems32.dllAppVIsvSubsystems32.wK
Source: omni.ja0.3.dr	String found in binary or memory: http://jsperf.com/code-review-1480
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.or
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: icucnv67.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Au3Check.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Au3Check.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: omni.ja0.3.dr	String found in binary or memory: http://www.ethiopic.org/Collation/OrderedLists.html.
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/key
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: omni.ja0.3.dr	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: rundll32.exe, rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, AztyGMg4jw.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1403293
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1592344
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: omni.ja0.3.dr	String found in binary or memory: https://crbug.com/993268
Source: omni.ja0.3.dr	String found in binary or memory: https://dap-02.api.divviup.org
Source: omni.ja0.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.5
Source: omni.ja0.3.dr	String found in binary or memory: https://design.firefox.com/photon/components/message-bars.html#type-specific-style
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#E
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Places/Frecency_algorithm
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: formautofill@mozilla.org.xpi.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/CSS/visibility#Values
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.c
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.cB
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree
Source: omni.ja0.3.dr	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: omni.ja0.3.dr	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/stylelint/stylelint/issues/6834
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/whatwg/html/issues/8610
Source: omni.ja0.3.dr	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: omni.ja0.3.dr	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#bidi-rendering
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#flow-content-3
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#hidden-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-details-and-summary-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-hr-element-2
Source: omni.ja0.3.dr	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: omni.ja0.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: omni.ja0.3.dr	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-escapes#single
Source: omni.ja0.3.dr	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: omni.ja0.3.dr	String found in binary or memory: https://prod.ohtc
Source: omni.ja0.3.dr	String found in binary or memory: https://profiler.firefox.com
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: omni.ja0.3.dr	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.o
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: omni.ja0.3.dr	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-maction
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#the-mathvariant-attribute
Source: omni.ja0.3.dr	String found in binary or memory: https://webcompat.com/issues/new
Source: omni.ja0.3.dr	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: omni.ja0.3.dr	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, AztyGMg4jw.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	String found in binary or memory: https://www.torproject.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning

Spam, unwanted Advertisements and Ransom Demands

Source: C:\instructions_read_me.txt

Dropped file: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0*!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us)*!* To restore all your PCs and get your network working again, follow these instructions:- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.Please follow these simple rules to avoid data corruption:- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself.Waiting you in a chat.

Jump to dropped file

Source: Yara match	File source: AztyGMg4jw.dll, type: SAMPLE
Source: Yara match	File source: 4.2.rundll32.exe.6d160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6d160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5692, type: MEMORYSTR

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\$WinREAgent\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\PerfLogs\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files (x86)\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\ProgramData\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\$WinREAgent\Scratch\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\7-Zip\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Adobe\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Common Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Google\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Internet Explorer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\MSBuild\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Reference Assemblies\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Uninstall Information\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Windows Defender\instructions_read_me.txt			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\$WinREAgent\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\PerfLogs\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files (x86)\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\ProgramData\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Users\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\$WinREAgent\Scratch\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files\7-Zip\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files (x86)\Windows Photo Viewer\en-GB\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.			Jump to dropped file

System Summary

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D164B00		4_2_6D164B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D16B1A9		4_2_6D16B1A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A0D90		4_2_6D1A0D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A2ED0		4_2_6D1A2ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C4ED0		4_2_6D1C4ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D196960		4_2_6D196960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1689A0		4_2_6D1689A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D182B70		4_2_6D182B70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D172B90		4_2_6D172B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D17EBD0		4_2_6D17EBD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D6A4C		4_2_6D1D6A4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D8A80		4_2_6D1D8A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D4440		4_2_6D1D4440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1DC7B2		4_2_6D1DC7B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1AA690		4_2_6D1AA690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A42B0		4_2_6D1A42B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D177DD0		4_2_6D177DD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A3C40		4_2_6D1A3C40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D17FCE0		4_2_6D17FCE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D17DF00		4_2_6D17DF00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C7E58		4_2_6D1C7E58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D19BE40		4_2_6D19BE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A3E64		4_2_6D1A3E64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1EB929		4_2_6D1EB929
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1AB9A0		4_2_6D1AB9A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D1825		4_2_6D1D1825
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D1B67		4_2_6D1D1B67
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D199BD0		4_2_6D199BD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D19DBE0		4_2_6D19DBE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1E95E5		4_2_6D1E95E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D179450		4_2_6D179450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D199470		4_2_6D199470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1AB4B0		4_2_6D1AB4B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D165790		4_2_6D165790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C97DE		4_2_6D1C97DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1757C0		4_2_6D1757C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A3620		4_2_6D1A3620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D197000		4_2_6D197000

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C2A18 appears 57 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C38F5 appears 73 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C39A0 appears 64 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D16D840 appears 40 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C38C2 appears 98 times

Source: AztyGMg4jw.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: AppvIsvSubsystems32.dll.3.dr

Binary string: for %1% in name mapper. Error: %2%related_name_resolver::initFailed to map NT object name for %1% in name mapper.related_name_resolver::get_name_by_handle\Device\\logfiles\HostDriverStoreWow64 mapper detected process running under wow64.wow64_name_mapper::initWow64DisableWow64FsRedirection\driverstoreWow64RevertWow64FsRedirectionFailed tU

Source: classification engine

Classification label: mal92.rans.spre.evad.winDLL@10/951@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Program Files\instructions_read_me.txt

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\instructions_read_me.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\ofijweiuhuewhcsaxs.mutex

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Jump to behavior

Source: AztyGMg4jw.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Program Files\Mozilla Firefox\application.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry

Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %ssig_%s_%08x_%08xupd_%s_%s
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: softokn3.dll.3.dr	Binary or memory string: updateDir=libraryDescription=slotDescription=cryptoSlotDescription=dbSlotDescription=FIPSSlotDescription=tokenDescription=cryptoTokenDescription=updateTokenDescription=dbTokenDescription=FIPSTokenDescription=minPWLen=secmod=manufacturerID=updateID=DROP TABLE IF EXISTS metaData;SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;PRAGMA table_info(%s);PKCS 110000000000000000Mozilla Rules the World through NSS! AND NSS Application Token %08x NSS FIPS 140-2 Certificate DB NSS Internal Crypto Services NSS Generic Crypto Services NSS 3
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: AztyGMg4jw.dll	ReversingLabs: Detection: 65%
Source: AztyGMg4jw.dll	Virustotal: Detection: 77%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",VisibleEntry
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",VisibleEntry			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File written: C:\Program Files\Mozilla Firefox\application.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\Pfm\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\default_apps\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Extensions\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\MEIPreload\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\WidevineCdm\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\instructions_read_me.txt			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\instructions_read_me.txt			Jump to behavior

Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AztyGMg4jw.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: AztyGMg4jw.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr

Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1C389F push ecx; ret

4_2_6D1C38B2

Persistence and Installation Behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozglue.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\notificationserver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozwer.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zFM.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nssckbi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\osclientcerts.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nss3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libGLESv2.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\msvcp140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\qipcap64.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zG.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\softokn3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140.dll			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 2159

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 5.7 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6208	Thread sleep count: 256 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3532	Thread sleep count: 2159 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1E571F FindFirstFileExW,		4_2_6D1E571F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D165790 FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,__alldvrm,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Mtx_unlock,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		4_2_6D165790

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1CE243 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6D1CE243

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1E6985 GetProcessHeap,

4_2_6D1E6985

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1CE243 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6D1CE243
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C39F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6D1C39F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C3B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_6D1C3B18

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1C34F1 cpuid

4_2_6D1C34F1

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		4_2_6D1E8C68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		4_2_6D1DEFA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		4_2_6D1E8963
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		4_2_6D1E8B92
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6D1DEA1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		4_2_6D1E8A8C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6D1E859F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6D1E85EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		4_2_6D1E84F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,		4_2_6D1E8710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6D1E8685
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoEx,		4_2_6D1C2229
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,		4_2_6D1E82F3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1C3D15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6D1C3D15

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1E4FC3 GetTimeZoneInformation,

4_2_6D1E4FC3

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior