Analysis Report Documenten_9274874 8574977265.doc

Overview

General Information

Sample Name: Documenten_9274874 8574977265.doc
Analysis ID: 336491
MD5: bc3ed27ffbbac4cc7695d46ebc3b83f1
SHA1: ef1d0558f18c3b211e9cbd47b95ec495ddebac14
SHA256: 52e89702b8ccddf31e9439639ca20f45dc8e5ef0ea74312573112605b726df1d

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://veterinariadrpopui.com/content/5f18Q/ Avira URL Cloud: Label: malware
Source: http://khanhhoahomnay.net/wordpress/CGMC/ Avira URL Cloud: Label: malware
Source: http://shop.elemenslide.com/wp-content/n/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: Documenten_9274874 8574977265.doc Virustotal: Detection: 37% Perma Link
Source: Documenten_9274874 8574977265.doc ReversingLabs: Detection: 44%

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100021F0 CryptStringToBinaryW,CoTaskMemAlloc,CryptStringToBinaryW,StgDeserializePropVariant,CoTaskMemFree, 7_2_100021F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002730 StgSerializePropVariant,CryptBinaryToStringW,CoTaskMemAlloc,CryptBinaryToStringW,CoTaskMemFree,CoTaskMemFree, 7_2_10002730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_001D75AE CryptDecodeObjectEx, 14_2_001D75AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_001D109C FindFirstFileW, 14_2_001D109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: wpsapk.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 104.18.61.59:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 104.18.61.59:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: http://wpsapk.com/wp-admin/v/
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: http://sofsuite.com/wp-includes/2jm3nIk/
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: http://veterinariadrpopui.com/content/5f18Q/
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: http://shop.elemenslide.com/wp-content/n/
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: http://khanhhoahomnay.net/wordpress/CGMC/
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: http://campusexpo.org/department-of-odhmmkd/95eXZY/
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in memory: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wp-admin/v/ HTTP/1.1Host: wpsapk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/2jm3nIk/ HTTP/1.1Host: sofsuite.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /content/5f18Q/ HTTP/1.1Host: veterinariadrpopui.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wordpress/CGMC/ HTTP/1.1Host: khanhhoahomnay.netConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 209.59.139.39 209.59.139.39
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LIQUIDWEBUS LIQUIDWEBUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /gv38bn75mnjox2y/c6b9ni4/vj3ut3/kld53/bp623/r5qw7a8y6jtlf9qu/ HTTP/1.1DNT: 0Referer: 5.2.136.90/gv38bn75mnjox2y/c6b9ni4/vj3ut3/kld53/bp623/r5qw7a8y6jtlf9qu/Content-Type: multipart/form-data; boundary=-------------------HmagTJdPQZ43LVgAX2LUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 5684Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_001E023A InternetReadFile, 14_2_001E023A
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{24B14A20-30CA-4646-ACFF-79FC9E14ADCB}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /wp-admin/v/ HTTP/1.1Host: wpsapk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/2jm3nIk/ HTTP/1.1Host: sofsuite.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /content/5f18Q/ HTTP/1.1Host: veterinariadrpopui.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wordpress/CGMC/ HTTP/1.1Host: khanhhoahomnay.netConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2117217440.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111910597.0000000001DA0000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: wpsapk.com
Source: unknown HTTP traffic detected: POST /gv38bn75mnjox2y/c6b9ni4/vj3ut3/kld53/bp623/r5qw7a8y6jtlf9qu/ HTTP/1.1DNT: 0Referer: 5.2.136.90/gv38bn75mnjox2y/c6b9ni4/vj3ut3/kld53/bp623/r5qw7a8y6jtlf9qu/Content-Type: multipart/form-data; boundary=-------------------HmagTJdPQZ43LVgAX2LUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 5684Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: http://campusexpo.org/department-of-odhmmkd/95eXZY/
Source: rundll32.exe, 00000006.00000002.2117217440.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111910597.0000000001DA0000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2117217440.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111910597.0000000001DA0000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2114223175.00000000038E8000.00000004.00000001.sdmp String found in binary or memory: http://khanhhoahomnay.net
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: http://khanhhoahomnay.net/wordpress/CGMC/
Source: rundll32.exe, 00000006.00000002.2119198742.0000000001E17000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2112858407.0000000001F87000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2113351173.0000000001F77000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2119198742.0000000001E17000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2112858407.0000000001F87000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2113351173.0000000001F77000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2109131645.00000000023C0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114086718.00000000027A0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2114620463.00000000026D0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2119198742.0000000001E17000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2112858407.0000000001F87000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2113351173.0000000001F77000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2114223175.00000000038E8000.00000004.00000001.sdmp String found in binary or memory: http://shop.elemenslide.com
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: http://shop.elemenslide.com/wp-content/n/
Source: powershell.exe, 00000005.00000002.2113994382.0000000003863000.00000004.00000001.sdmp String found in binary or memory: http://sofsuite.com
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: http://sofsuite.com/wp-includes/2jm3nIk/
Source: powershell.exe, 00000005.00000002.2114107313.00000000038AD000.00000004.00000001.sdmp String found in binary or memory: http://veterinariadrpopui.com
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: http://veterinariadrpopui.com/content/5f18Q/
Source: rundll32.exe, 00000006.00000002.2119198742.0000000001E17000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2112858407.0000000001F87000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2113351173.0000000001F77000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2113972986.0000000003846000.00000004.00000001.sdmp String found in binary or memory: http://wpsapk.com
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: http://wpsapk.com/wp-admin/v/
Source: powershell.exe, 00000005.00000002.2109131645.00000000023C0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114086718.00000000027A0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2114620463.00000000026D0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2117217440.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111910597.0000000001DA0000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2119198742.0000000001E17000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2112858407.0000000001F87000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2113351173.0000000001F77000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2117217440.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111910597.0000000001DA0000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2108564862.00000000002B4000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2108564862.00000000002B4000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000008.00000002.2113058127.0000000001D90000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2113094519.0000000003512000.00000004.00000001.sdmp String found in binary or memory: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/
Source: powershell.exe, 00000005.00000002.2114107313.00000000038AD000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2113985934.000000000384E000.00000004.00000001.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000B.00000002.2118205619.0000000000360000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2119457993.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2110989344.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2122389550.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2119525565.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2111086691.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2112555431.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2113546324.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2113574384.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2122425007.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2118310985.0000000000381000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2112508539.0000000000300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2115211069.0000000000240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2349243724.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2349226976.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2115944509.00000000007E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 11.2.rundll32.exe.380000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.7e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.300000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.300000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I of I Words:
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I of I Words: 3 N@m 13 ;a 10096 G)
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. K O a S
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. K O a S
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Document contains an embedded VBA macro with suspicious strings
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set SblcDCC = pULquU.CreateTextFile("OMySJHB:\AyVGlHzV\jPNIAFF.VJueCC")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set fNhiCVgGS = RyDBDK.CreateTextFile("YJYLAnEDp:\qjyoGCI\dkSAD.MSPmBF")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set HCvCmAcHC = iFTmFHFH.CreateTextFile("shCgAEb:\vCjFDhHuA\RhZGDG.mHWOGnIf")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set gEcrV = RqlOZAHRJ.CreateTextFile("HQGixyC:\vETCeBG\zIuEqsGG.NobmDA")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set ZMdrVHGz = xsruLB.CreateTextFile("EEnWBhBO:\VaTRC\McdbPkJ.cvwiQ")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set fDZVKAAc = tzErBRFe.CreateTextFile("RcEcpI:\TGsCxLC\hxAZEBGHI.oETVAFo")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set rYbgBh = hZCth.CreateTextFile("fYRUCAB:\VWWOMB\QmLUE.hKgcGBDCJ")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set GfRPP = xLQtMd.CreateTextFile("RyteBlQC:\fuQXAW\oueKCbIJ.WivEYJD")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set sCOIGDtD = eepvDEaE.CreateTextFile("KlvicF:\bJfMJhqw\dAgvkWD.xDxpHH")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set fmwdEMADQ = DkLoDL.CreateTextFile("pGMMG:\enlVVB\fMqiFP.kEIECDZHz")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set pkixJADG = DhnHIY.CreateTextFile("rfyIZCD:\OrugCDDGG\qkyWDBUAH.gjwVDBALW")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set KmGOADt = CFdSBD.CreateTextFile("HWdKFJOBf:\UYiqcEIJ\rLoNox.YKOSA")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set PbhYVsA = PcHRGIADo.CreateTextFile("OiBXGJB:\pnqsZEDV\gsZoAW.EePnB")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set NuebA = sTzDC.CreateTextFile("OBoYzRpef:\sDLuJ\bmIQSG.MdmDR")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set gxBPJB = zxgLHJSFW.CreateTextFile("KGGMcAB:\uaMWhFR\mhdIDlEH.PDxHAHD")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set mgrwfmN = RjiQHRA.CreateTextFile("CxQnJUo:\GongJKJ\vntyZI.ugzmBCOCC")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set uWZkeMFv = zDsRaIBGF.CreateTextFile("NFKiIDO:\sBRpIz\FFqJD.QevLKGfGs")
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Set iHKuDmaEr = OMZxxg.CreateTextFile("QWqEKJnW:\BQVnVKF\gWdSBXA.TabDJBD")
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set SblcDCC = pULquU.CreateTextFile("OMySJHB:\AyVGlHzV\jPNIAFF.VJueCC") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fNhiCVgGS = RyDBDK.CreateTextFile("YJYLAnEDp:\qjyoGCI\dkSAD.MSPmBF") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set HCvCmAcHC = iFTmFHFH.CreateTextFile("shCgAEb:\vCjFDhHuA\RhZGDG.mHWOGnIf") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set gEcrV = RqlOZAHRJ.CreateTextFile("HQGixyC:\vETCeBG\zIuEqsGG.NobmDA") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set ZMdrVHGz = xsruLB.CreateTextFile("EEnWBhBO:\VaTRC\McdbPkJ.cvwiQ") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fDZVKAAc = tzErBRFe.CreateTextFile("RcEcpI:\TGsCxLC\hxAZEBGHI.oETVAFo") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set rYbgBh = hZCth.CreateTextFile("fYRUCAB:\VWWOMB\QmLUE.hKgcGBDCJ") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set GfRPP = xLQtMd.CreateTextFile("RyteBlQC:\fuQXAW\oueKCbIJ.WivEYJD") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set sCOIGDtD = eepvDEaE.CreateTextFile("KlvicF:\bJfMJhqw\dAgvkWD.xDxpHH") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fmwdEMADQ = DkLoDL.CreateTextFile("pGMMG:\enlVVB\fMqiFP.kEIECDZHz") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set pkixJADG = DhnHIY.CreateTextFile("rfyIZCD:\OrugCDDGG\qkyWDBUAH.gjwVDBALW") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set KmGOADt = CFdSBD.CreateTextFile("HWdKFJOBf:\UYiqcEIJ\rLoNox.YKOSA") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set PbhYVsA = PcHRGIADo.CreateTextFile("OiBXGJB:\pnqsZEDV\gsZoAW.EePnB") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set NuebA = sTzDC.CreateTextFile("OBoYzRpef:\sDLuJ\bmIQSG.MdmDR") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set gxBPJB = zxgLHJSFW.CreateTextFile("KGGMcAB:\uaMWhFR\mhdIDlEH.PDxHAHD") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set mgrwfmN = RjiQHRA.CreateTextFile("CxQnJUo:\GongJKJ\vntyZI.ugzmBCOCC") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String createtextfile: Set uWZkeMFv = zDsRaIBGF.CreateTextFile("NFKiIDO:\sBRpIz\FFqJD.QevLKGfGs") Name: Hrs2a1p95u19
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String createtextfile: Set iHKuDmaEr = OMZxxg.CreateTextFile("QWqEKJnW:\BQVnVKF\gWdSBXA.TabDJBD") Name: Hrs2a1p95u19
Document contains an embedded VBA with base64 encoded strings
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String uTtCAFwHpCGF
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String lwWhZGEasjsS
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String MiCjaGqJfPrI
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String KqVyuQQfwTWh
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String mehEFPFHcklgJDDx
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String wypNISsWSXthFJCq
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String LvnHAGHfIhRDBRAF
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String NeiIGCNWgICn
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String NisSEYrcDlKQUITa
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String nJJzFRjEWpRikxCD
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String oLweAMoGsqVE
Very long command line found
Source: unknown Process created: Commandline size = 5709
Source: unknown Process created: Commandline size = 5613
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5613 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Vzmpbxrgkn\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000976F 7_2_1000976F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023B41F 7_2_0023B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00232C63 7_2_00232C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00243895 7_2_00243895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023C0C6 7_2_0023C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023EE78 7_2_0023EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023568E 7_2_0023568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002402C3 7_2_002402C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002442DA 7_2_002442DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238736 7_2_00238736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237B63 7_2_00237B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00244B41 7_2_00244B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024340A 7_2_0024340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024687F 7_2_0024687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023F444 7_2_0023F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023E05A 7_2_0023E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024A0AF 7_2_0024A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002380BA 7_2_002380BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002360B9 7_2_002360B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002348BD 7_2_002348BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024889D 7_2_0024889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002388E5 7_2_002388E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00231CFA 7_2_00231CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002420C5 7_2_002420C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023F536 7_2_0023F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00240D33 7_2_00240D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023153C 7_2_0023153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247D03 7_2_00247D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023B112 7_2_0023B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248D1C 7_2_00248D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245D1D 7_2_00245D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024511B 7_2_0024511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002369A0 7_2_002369A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002461B8 7_2_002461B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00246DB9 7_2_00246DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00249586 7_2_00249586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023F98C 7_2_0023F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237998 7_2_00237998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00236D9F 7_2_00236D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002431E2 7_2_002431E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002471EF 7_2_002471EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00232A30 7_2_00232A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00239A37 7_2_00239A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00234A35 7_2_00234A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247A0F 7_2_00247A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245A61 7_2_00245A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023EA4C 7_2_0023EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002362A3 7_2_002362A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00231280 7_2_00231280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002412E2 7_2_002412E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002426F5 7_2_002426F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002396CD 7_2_002396CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248ADC 7_2_00248ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023BB3A 7_2_0023BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00240F0C 7_2_00240F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242B16 7_2_00242B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247F1F 7_2_00247F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023C769 7_2_0023C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00240B68 7_2_00240B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023E377 7_2_0023E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241773 7_2_00241773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00235B79 7_2_00235B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238F78 7_2_00238F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00249B45 7_2_00249B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242349 7_2_00242349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248F49 7_2_00248F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00236754 7_2_00236754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023B75F 7_2_0023B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002473AC 7_2_002473AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002317AC 7_2_002317AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024878F 7_2_0024878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023839D 7_2_0023839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00243FE7 7_2_00243FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023D7EB 7_2_0023D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002467E9 7_2_002467E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002463C1 7_2_002463C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241BDF 7_2_00241BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00239FDC 7_2_00239FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032B41F 8_2_0032B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032EE78 8_2_0032EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00322C63 8_2_00322C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00333895 8_2_00333895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032568E 8_2_0032568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003342DA 8_2_003342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003302C3 8_2_003302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032C0C6 8_2_0032C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00328736 8_2_00328736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00327B63 8_2_00327B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00334B41 8_2_00334B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003363C1 8_2_003363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00322A30 8_2_00322A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00329A37 8_2_00329A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00324A35 8_2_00324A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0033340A 8_2_0033340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00337A0F 8_2_00337A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0033687F 8_2_0033687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00335A61 8_2_00335A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032E05A 8_2_0032E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032F444 8_2_0032F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032EA4C 8_2_0032EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003280BA 8_2_003280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003260B9 8_2_003260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003248BD 8_2_003248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003262A3 8_2_003262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0033A0AF 8_2_0033A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0033889D 8_2_0033889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00321280 8_2_00321280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003326F5 8_2_003326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00321CFA 8_2_00321CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003312E2 8_2_003312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003288E5 8_2_003288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00338ADC 8_2_00338ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003320C5 8_2_003320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003296CD 8_2_003296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00330D33 8_2_00330D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032F536 8_2_0032F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032BB3A 8_2_0032BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032153C 8_2_0032153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032B112 8_2_0032B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00332B16 8_2_00332B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0033511B 8_2_0033511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00337F1F 8_2_00337F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00335D1D 8_2_00335D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00338D1C 8_2_00338D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00337D03 8_2_00337D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00330F0C 8_2_00330F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00331773 8_2_00331773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032E377 8_2_0032E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00328F78 8_2_00328F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00325B79 8_2_00325B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032C769 8_2_0032C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00330B68 8_2_00330B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00326754 8_2_00326754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032B75F 8_2_0032B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00339B45 8_2_00339B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00332349 8_2_00332349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00338F49 8_2_00338F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00336DB9 8_2_00336DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003361B8 8_2_003361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003269A0 8_2_003269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003217AC 8_2_003217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003373AC 8_2_003373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00327998 8_2_00327998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00326D9F 8_2_00326D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032839D 8_2_0032839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00339586 8_2_00339586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0033878F 8_2_0033878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032F98C 8_2_0032F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003331E2 8_2_003331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00333FE7 8_2_00333FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0032D7EB 8_2_0032D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003367E9 8_2_003367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_003371EF 8_2_003371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00331BDF 8_2_00331BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00329FDC 8_2_00329FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB41F 9_2_001DB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEE78 9_2_001DEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2C63 9_2_001D2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E3895 9_2_001E3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D568E 9_2_001D568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E42DA 9_2_001E42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC0C6 9_2_001DC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E02C3 9_2_001E02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8736 9_2_001D8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E4B41 9_2_001E4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7B63 9_2_001D7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E63C1 9_2_001E63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7A0F 9_2_001E7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E340A 9_2_001E340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D4A35 9_2_001D4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9A37 9_2_001D9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2A30 9_2_001D2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE05A 9_2_001DE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEA4C 9_2_001DEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF444 9_2_001DF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E687F 9_2_001E687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5A61 9_2_001E5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E889D 9_2_001E889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1280 9_2_001D1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D48BD 9_2_001D48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D60B9 9_2_001D60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D80BA 9_2_001D80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EA0AF 9_2_001EA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D62A3 9_2_001D62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8ADC 9_2_001E8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D96CD 9_2_001D96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E20C5 9_2_001E20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1CFA 9_2_001D1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E26F5 9_2_001E26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D88E5 9_2_001D88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E12E2 9_2_001E12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7F1F 9_2_001E7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8D1C 9_2_001E8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5D1D 9_2_001E5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E511B 9_2_001E511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2B16 9_2_001E2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB112 9_2_001DB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0F0C 9_2_001E0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7D03 9_2_001E7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D153C 9_2_001D153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DBB3A 9_2_001DBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF536 9_2_001DF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0D33 9_2_001E0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB75F 9_2_001DB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6754 9_2_001D6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2349 9_2_001E2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8F49 9_2_001E8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9B45 9_2_001E9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5B79 9_2_001D5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8F78 9_2_001D8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE377 9_2_001DE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1773 9_2_001E1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC769 9_2_001DC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0B68 9_2_001E0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D839D 9_2_001D839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6D9F 9_2_001D6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7998 9_2_001D7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E878F 9_2_001E878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF98C 9_2_001DF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9586 9_2_001E9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E61B8 9_2_001E61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E6DB9 9_2_001E6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D17AC 9_2_001D17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E73AC 9_2_001E73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D69A0 9_2_001D69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1BDF 9_2_001E1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9FDC 9_2_001D9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E71EF 9_2_001E71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DD7EB 9_2_001DD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E67E9 9_2_001E67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E3FE7 9_2_001E3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E31E2 9_2_001E31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EEE78 10_2_007EEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E2C63 10_2_007E2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EB41F 10_2_007EB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F42DA 10_2_007F42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EC0C6 10_2_007EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F02C3 10_2_007F02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F3895 10_2_007F3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E568E 10_2_007E568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E7B63 10_2_007E7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F4B41 10_2_007F4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E8736 10_2_007E8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F63C1 10_2_007F63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F687F 10_2_007F687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F5A61 10_2_007F5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EE05A 10_2_007EE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EEA4C 10_2_007EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EF444 10_2_007EF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E9A37 10_2_007E9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E4A35 10_2_007E4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E2A30 10_2_007E2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F7A0F 10_2_007F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F340A 10_2_007F340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E1CFA 10_2_007E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F26F5 10_2_007F26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E88E5 10_2_007E88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F12E2 10_2_007F12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F8ADC 10_2_007F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E96CD 10_2_007E96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F20C5 10_2_007F20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E48BD 10_2_007E48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E80BA 10_2_007E80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E60B9 10_2_007E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007FA0AF 10_2_007FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E62A3 10_2_007E62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F889D 10_2_007F889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E1280 10_2_007E1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E8F78 10_2_007E8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E5B79 10_2_007E5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EE377 10_2_007EE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F1773 10_2_007F1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EC769 10_2_007EC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F0B68 10_2_007F0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EB75F 10_2_007EB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E6754 10_2_007E6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F2349 10_2_007F2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F8F49 10_2_007F8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F9B45 10_2_007F9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E153C 10_2_007E153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EBB3A 10_2_007EBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EF536 10_2_007EF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F0D33 10_2_007F0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F7F1F 10_2_007F7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F5D1D 10_2_007F5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F8D1C 10_2_007F8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F511B 10_2_007F511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F2B16 10_2_007F2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EB112 10_2_007EB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F0F0C 10_2_007F0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F7D03 10_2_007F7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F71EF 10_2_007F71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007ED7EB 10_2_007ED7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F67E9 10_2_007F67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F3FE7 10_2_007F3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F31E2 10_2_007F31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F1BDF 10_2_007F1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E9FDC 10_2_007E9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F6DB9 10_2_007F6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F61B8 10_2_007F61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E17AC 10_2_007E17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F73AC 10_2_007F73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E69A0 10_2_007E69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E6D9F 10_2_007E6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E839D 10_2_007E839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007E7998 10_2_007E7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F878F 10_2_007F878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007EF98C 10_2_007EF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_007F9586 10_2_007F9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038B41F 11_2_0038B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038EE78 11_2_0038EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00382C63 11_2_00382C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00393895 11_2_00393895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038568E 11_2_0038568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003942DA 11_2_003942DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003902C3 11_2_003902C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038C0C6 11_2_0038C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00388736 11_2_00388736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00387B63 11_2_00387B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00394B41 11_2_00394B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003963C1 11_2_003963C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00382A30 11_2_00382A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00384A35 11_2_00384A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00389A37 11_2_00389A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0039340A 11_2_0039340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00397A0F 11_2_00397A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0039687F 11_2_0039687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00395A61 11_2_00395A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038E05A 11_2_0038E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038EA4C 11_2_0038EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038F444 11_2_0038F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003860B9 11_2_003860B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003880BA 11_2_003880BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003848BD 11_2_003848BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0039A0AF 11_2_0039A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003862A3 11_2_003862A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0039889D 11_2_0039889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00381280 11_2_00381280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00381CFA 11_2_00381CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003926F5 11_2_003926F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003912E2 11_2_003912E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003888E5 11_2_003888E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00398ADC 11_2_00398ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003896CD 11_2_003896CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003920C5 11_2_003920C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038BB3A 11_2_0038BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038153C 11_2_0038153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00390D33 11_2_00390D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038F536 11_2_0038F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0039511B 11_2_0039511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00395D1D 11_2_00395D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00398D1C 11_2_00398D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00397F1F 11_2_00397F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038B112 11_2_0038B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00392B16 11_2_00392B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00390F0C 11_2_00390F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00397D03 11_2_00397D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00388F78 11_2_00388F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00385B79 11_2_00385B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00391773 11_2_00391773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038E377 11_2_0038E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038C769 11_2_0038C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00390B68 11_2_00390B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038B75F 11_2_0038B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00386754 11_2_00386754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00392349 11_2_00392349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00398F49 11_2_00398F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00399B45 11_2_00399B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00396DB9 11_2_00396DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003961B8 11_2_003961B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003817AC 11_2_003817AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003973AC 11_2_003973AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003869A0 11_2_003869A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00387998 11_2_00387998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038839D 11_2_0038839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00386D9F 11_2_00386D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038F98C 11_2_0038F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0039878F 11_2_0039878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00399586 11_2_00399586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003967E9 11_2_003967E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0038D7EB 11_2_0038D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003971EF 11_2_003971EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003931E2 11_2_003931E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00393FE7 11_2_00393FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00389FDC 11_2_00389FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00391BDF 11_2_00391BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B41F 12_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00222C63 12_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022EE78 12_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022568E 12_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00233895 12_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002302C3 12_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022C0C6 12_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002342DA 12_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00228736 12_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00227B63 12_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00234B41 12_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002363C1 12_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00222A30 12_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00229A37 12_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00224A35 12_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023340A 12_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237A0F 12_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00235A61 12_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023687F 12_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F444 12_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022EA4C 12_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022E05A 12_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002262A3 12_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023A0AF 12_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002280BA 12_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002260B9 12_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002248BD 12_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00221280 12_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023889D 12_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002312E2 12_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002288E5 12_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002326F5 12_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00221CFA 12_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002320C5 12_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002296CD 12_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238ADC 12_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230D33 12_2_00230D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F536 12_2_0022F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022BB3A 12_2_0022BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022153C 12_2_0022153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237D03 12_2_00237D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230F0C 12_2_00230F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B112 12_2_0022B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00232B16 12_2_00232B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023511B 12_2_0023511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237F1F 12_2_00237F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00235D1D 12_2_00235D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238D1C 12_2_00238D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022C769 12_2_0022C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230B68 12_2_00230B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00231773 12_2_00231773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022E377 12_2_0022E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00228F78 12_2_00228F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00225B79 12_2_00225B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00239B45 12_2_00239B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00232349 12_2_00232349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238F49 12_2_00238F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00226754 12_2_00226754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B75F 12_2_0022B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002269A0 12_2_002269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002217AC 12_2_002217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002373AC 12_2_002373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00236DB9 12_2_00236DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002361B8 12_2_002361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00239586 12_2_00239586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023878F 12_2_0023878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F98C 12_2_0022F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00227998 12_2_00227998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00226D9F 12_2_00226D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022839D 12_2_0022839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002331E2 12_2_002331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00233FE7 12_2_00233FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022D7EB 12_2_0022D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002367E9 12_2_002367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002371EF 12_2_002371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00231BDF 12_2_00231BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00229FDC 12_2_00229FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020B41F 13_2_0020B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00202C63 13_2_00202C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020EE78 13_2_0020EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020568E 13_2_0020568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00213895 13_2_00213895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002102C3 13_2_002102C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020C0C6 13_2_0020C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002142DA 13_2_002142DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00208736 13_2_00208736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00207B63 13_2_00207B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00214B41 13_2_00214B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002163C1 13_2_002163C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00202A30 13_2_00202A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00204A35 13_2_00204A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00209A37 13_2_00209A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021340A 13_2_0021340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00217A0F 13_2_00217A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00215A61 13_2_00215A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021687F 13_2_0021687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020F444 13_2_0020F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020EA4C 13_2_0020EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0020E05A 13_2_0020E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002062A3 13_2_002062A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021A0AF 13_2_0021A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002060B9 13_2_002060B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002080BA 13_2_002080BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002048BD 13_2_002048BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00201280 13_2_00201280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021889D 13_2_0021889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002112E2 13_2_002112E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002088E5 13_2_002088E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002126F5 13_2_002126F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00201CFA 13_2_00201CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002120C5 13_2_002120C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002096CD 13_2_002096CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00218ADC 13_2_00218ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00210D33 13_2_00210D33
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: Documenten_9274874 8574977265.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module A5gd21klfqu9c6rs, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: Documenten_9274874 8574977265.doc OLE indicator, VBA macros: true
Yara signature match
Source: 00000005.00000002.2108701302.0000000001C26000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2108539284.0000000000196000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: rundll32.exe, 00000006.00000002.2117217440.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111910597.0000000001DA0000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@24/8@7/5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_001D1C88 CreateToolhelp32Snapshot, 14_2_001D1C88
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002D70 SysAllocString,CoCreateInstance,PropVariantClear,SysFreeString,SysFreeString, 7_2_10002D70
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$cumenten_9274874 8574977265.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD91F.tmp Jump to behavior
Source: Documenten_9274874 8574977265.doc OLE indicator, Word Document stream: true
Source: Documenten_9274874 8574977265.doc OLE document summary: title field not present or empty
Source: Documenten_9274874 8574977265.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ............J........................... ...............................................#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............J...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......X.......L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K........H............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................C.j......................J.............}..v.....]p.....0.u............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................C.j..... J...............J.............}..v.....]p.....0.u...............H............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................C.j......................J.............}..v....pjp.....0.u............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................C.j......H...............J.............}..v.....kp.....0.u.............8.H............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............|C.j......................J.............}..v......q.....0.u............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............|C.j..... J...............J.............}..v....H.q.....0.u...............H............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'...............,D.j....E.................J.............}..v.....8......0.u...............H............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....+...............,D.j....E.................J.............}..v....@w......0.u...............H............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior