Windows Analysis Report PAYMENT ADVICE.doc

Overview

General Information

Sample Name:	PAYMENT ADVICE.doc
Analysis ID:	452655
MD5:	71af183490ef5c747eb3b6a1417c8f33
SHA1:	cbf5c744909fb1978d8bbadb3b1377e7b364f90d
SHA256:	fd1d1d4f70fb3b258e798ba9ac66abd6ad9d9de16b4b2204f55519ea59eb7d12
Tags:	doc
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected AgentTesla

Contains functionality to register a low level keyboard hook

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Adds / modifies Windows certificates

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Office Equation Editor has been started

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: http://maritradeshipplng.com/wayss/okilo.exe

Avira URL Cloud: Label: malware

Found malware configuration

Source: 7.2.merciesxdncdc.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "max.mccanna@metaltek.me", "Password": "GODGRACE12345", "Host": "mail.privateemail.com"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\okilo[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Roaming\JxCmQoa.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: PAYMENT ADVICE.doc

ReversingLabs: Detection: 26%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\okilo[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\JxCmQoa.exe	Joe Sandbox ML: detected

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe			Jump to behavior

Office Equation Editor has been started

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: Joe Sandbox View	IP Address: 104.21.27.166 104.21.27.166
Source: Joe Sandbox View	IP Address: 198.54.122.60 198.54.122.60

Source: merciesxdncdc.exe, 00000007.00000002.2347049705.0000000002461000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: merciesxdncdc.exe, 00000007.00000002.2347049705.0000000002461000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: merciesxdncdc.exe, 00000007.00000002.2347049705.0000000002461000.00000004.00000001.sdmp	String found in binary or memory: http://IXudBJ.com
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: merciesxdncdc.exe, merciesxdncdc.exe, 00000007.00000000.2140079675.00000000009D2000.00000020.00020000.sdmp, merciesxdncdc.exe.2.dr	String found in binary or memory: http://api.twitter.com/1/direct_messages.xml?since_id=
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/seccli/repository/CRL.der0J
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2351633148.0000000006293000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: merciesxdncdc.exe, 00000007.00000002.2346420413.0000000000552000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2346447989.000000000057D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2351540705.00000000061F0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2351633148.0000000006293000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: merciesxdncdc.exe, 00000007.00000003.2227114582.0000000006293000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: merciesxdncdc.exe, 00000007.00000002.2346354699.00000000004DE000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab$
Source: merciesxdncdc.exe, 00000007.00000002.2346354699.00000000004DE000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2c66211f8785b
Source: merciesxdncdc.exe, 00000007.00000002.2346420413.0000000000552000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enW
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: merciesxdncdc.exe, 00000007.00000002.2347296041.00000000025A6000.00000004.00000001.sdmp	String found in binary or memory: http://mail.privateemail.com
Source: merciesxdncdc.exe, 00000007.00000002.2351633148.0000000006293000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: merciesxdncdc.exe, 00000007.00000002.2351540705.00000000061F0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: merciesxdncdc.exe, 00000007.00000002.2351540705.00000000061F0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: merciesxdncdc.exe, 00000007.00000002.2351540705.00000000061F0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: merciesxdncdc.exe, 00000007.00000002.2351540705.00000000061F0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: merciesxdncdc.exe, 00000007.00000002.2351633148.0000000006293000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: merciesxdncdc.exe, 00000007.00000002.2351007158.0000000005D80000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: merciesxdncdc.exe, 00000007.00000002.2354088595.0000000007970000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: merciesxdncdc.exe, merciesxdncdc.exe, 00000007.00000000.2140079675.00000000009D2000.00000020.00020000.sdmp, merciesxdncdc.exe.2.dr	String found in binary or memory: http://twitter.com/statuses/user_timeline.xml?screen_name=
Source: merciesxdncdc.exe, 00000007.00000002.2351007158.0000000005D80000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0;
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.a-cert.at0E
Source: merciesxdncdc.exe, 00000007.00000003.2227055337.000000000628C000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0;
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: merciesxdncdc.exe, 00000007.00000003.2226349491.00000000062A9000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: merciesxdncdc.exe, 00000007.00000003.2226349491.00000000062A9000.00000004.00000001.sdmp	String found in binary or memory: http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: merciesxdncdc.exe, 00000007.00000003.2227055337.000000000628C000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/Client1.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/net1.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.firmaprofesional.com0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.post.trust.ie/reposit/cps.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.registradores.org/scr/normativa/cp_f2.htm0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.rootca.or.kr/rca/cps.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/current.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/de/directory/cps.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/guidelines0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: http://www.wellsfargo.com/certpolicy0
Source: merciesxdncdc.exe, 00000007.00000002.2347741002.00000000028A5000.00000004.00000001.sdmp, merciesxdncdc.exe, 00000007.00000002.2347870070.000000000292B000.00000004.00000001.sdmp, merciesxdncdc.exe, 00000007.00000002.2347810118.0000000002902000.00000004.00000001.sdmp	String found in binary or memory: https://N9CITA5Q9HG.org
Source: merciesxdncdc.exe, 00000007.00000003.2226188928.00000000062DF000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/seccli/repository/CPS0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: merciesxdncdc.exe, 00000007.00000002.2351633148.0000000006293000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0
Source: merciesxdncdc.exe, 00000007.00000002.2351571827.000000000621B000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
Source: merciesxdncdc.exe, 00000007.00000003.2226041475.0000000007EFC000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
Source: merciesxdncdc.exe, 00000007.00000003.2226569251.000000000627F000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: merciesxdncdc.exe, 00000007.00000003.2226277785.000000000626E000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: merciesxdncdc.exe, 00000007.00000002.2346238680.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: merciesxdncdc.exe, 00000007.00000002.2347049705.0000000002461000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\okilo[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00265338	7_2_00265338
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00266350	7_2_00266350
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00265680	7_2_00265680
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_0026EF20	7_2_0026EF20
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_002620AB	7_2_002620AB
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00470B70	7_2_00470B70
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00479D10	7_2_00479D10
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_0047D119	7_2_0047D119
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00476580	7_2_00476580
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_004773A8	7_2_004773A8
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_0047D6F8	7_2_0047D6F8
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_0047EF49	7_2_0047EF49
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_004779C8	7_2_004779C8
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00482AD0	7_2_00482AD0
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Code function: 7_2_00480683	7_2_00480683

Source: okilo[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: merciesxdncdc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: JxCmQoa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: okilo[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: merciesxdncdc.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: JxCmQoa.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: okilo[1].exe.2.dr, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	Cryptographic APIs: 'CreateDecryptor'
Source: merciesxdncdc.exe.2.dr, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	Cryptographic APIs: 'CreateDecryptor'
Source: JxCmQoa.exe.4.dr, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe C:\Users\user\AppData\Roaming\merciesxdncdc.exe
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\JxCmQoa' /XML 'C:\Users\user\AppData\Local\Temp\tmp2E52.tmp'
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe C:\Users\user\AppData\Roaming\merciesxdncdc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\JxCmQoa' /XML 'C:\Users\user\AppData\Local\Temp\tmp2E52.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process created: C:\Users\user\AppData\Roaming\merciesxdncdc.exe C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Jump to behavior

Source: initial sample	Static PE information: section name: .text entropy: 7.56992954159
Source: initial sample	Static PE information: section name: .text entropy: 7.56992954159
Source: initial sample	Static PE information: section name: .text entropy: 7.56992954159

Source: okilo[1].exe.2.dr, TYrkToaGEMpjujrFga/prFipO63mgI0yvrVyq.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'T4ltQqiAVA', 'y5ALwKxnOC', 'SPFLlBsnwk', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'YDGLJl8xAQ'
Source: okilo[1].exe.2.dr, SxfIUXVJdgBjNDLFNB/AM2hB8Lor7USiIUZxs.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'vYjtFVkHe8', 'hSbFCsIf9U', 'VBYFGHvDmK', 'H6tFAkBj2Z', 'd1kFDWfdZN', 'L3LFTMp8Vp', 'QvMFQUJcSm', 'Xg0FwSp5eu'
Source: okilo[1].exe.2.dr, ngYh84jGCP5wkphDFk5/yEIfrdj7Dt1Iw9K447j.cs	High entropy of concatenated method names: '.ctor', 'q9OaGjku7c', 'TJ7aAv00Et', 'f0jaDqJSk2', 'qBHaTNRD8W', 'xkNaQK4wah', 'rNpaw40VDI', 'CLMal09RDm', 'VSDaJ3xt4v', 'nGdazASDKU'
Source: okilo[1].exe.2.dr, okG58OBUEjZS4DZJG8/c2esVpS6KesUCjCATw.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'bbJZhccJiR', 'WlYYiQ9SWm', 'N60YcfEWYd', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'fbB55WM1tB'
Source: okilo[1].exe.2.dr, Q7gT9wnkWoJQtDsXhx/z2cKe65WbGPGIjxmwr.cs	High entropy of concatenated method names: 'GeLovehHWr', 'Fknosk0xkT', 'UkPo0qs5Tx', 'gW5oEr6ndm', 'Fnco8evmdm', 'KcsofG2qCq', 'bNZormYp4J', 'JyIoi8qVIn', 'V46omQE60N', 'IRnoIISvIs'
Source: okilo[1].exe.2.dr, LNBaGnEQA3vyBDvVVi/em9cs2DYHr6JrqXilP.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'r1dZFhqXD1', 'YUHZLREAL5', 'HqoZ5K4kGc', 'TeeZY8InhQ', 'QrFZrlH2LO', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl'
Source: okilo[1].exe.2.dr, YIrq8QHhDSfadQYNKS/xKDYPZQDg30Ao09YpT.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'y7xNDvof1h', 'Q435Ja1njk', 'UkP5zqs5Tx', 'gW5Ybr6ndm', 'ET3Y4eM0Ov', 'FncYoevmdm', 'KcsYUG2qCq', 'JyIYt8qVIn'
Source: okilo[1].exe.2.dr, Fa8VLXM23mORvR5dME/HCKUkDbh5y3OV2oc6A.cs	High entropy of concatenated method names: 'kfG46Gu61d', 'PTk4SqjEAg', 'fbB4eWM1tB', 'bqs422jkMh', 'HQR47fZ3vS', 'vXF494PUY4', 'kEZ4qjgk85', 'gvM41Y4HNO', 'GQJ4uSgJ1n', 'PjQ4K0TZCQ'
Source: okilo[1].exe.2.dr, bu1iYZjjaajwEIC7Iup/w9PdenjqgpAPWgp9wL5.cs	High entropy of concatenated method names: 'Dispose', 'QskaBtjAuY', 'AFqaPB2YbE', 'tVtaXuZSEy', 'get_Text', 'set_Text', '.ctor', 'OnPaint', 'rUR0VgYEXKD42V8HKGP', 'Fp8bSFYlanUNiKPqvWL'
Source: okilo[1].exe.2.dr, XcixWBkBVqsjcaY6KL/OFsmGHhgogBJuaQceU.cs	High entropy of concatenated method names: 'TBvUjS7lP8', 'Q4fUuNHHUD', 'KAFUylqVop', 'ChfU3RNQmq', 'xVFUPj7qNN', 'AGQUXMqKhN', 'jioUdE9HJL', 'J73URxXTnn', 'eJSUCUn5uo', 'd0UUGXJlsJ'
Source: okilo[1].exe.2.dr, edM23O9tYBo3W9lyds/OgdU2MJmnLuJrUAowu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'atTFyjqlwC', 'lriF3OBRwt', 'BreFBgaf10', 'KJ4FPKPpmT', 'zEfFXihnuJ', 'gcXFdvP77o', 'nAUFRaNNpm', 'JnrFHwJRTO'
Source: okilo[1].exe.2.dr, IHXFP9YcujtIe1fkv0/kTeD6mxEv4W0qYVQoh.cs	High entropy of concatenated method names: 'Q6RUMV6LIj', 'Oc1UOxefwD', 'ornUWFtLC6', 'hytUx6xd1I', 'L4NUv9v5d9', 'WP5UsWAMyC', 'ACsUplcTLj', 'xbdU0uPUah', 'rHFUE0Twv4', 'pAnUVksqey'
Source: okilo[1].exe.2.dr, xn2PL6Ay0FbgjDCQUf/UyLOepCdZDDnGoRbQD.cs	High entropy of concatenated method names: '.ctor', 'opga4Q0sxF', 'BItaorKZTM', 'pLAaUnwosb', 'uAhatLyxpT', 'RARaNRD0l6', 'K9oaZAurMg', 'XCK7Hf3gDDwBligG6BE', 'QhJb123S9cGrcrHo9qN', 'Mv0W6M3PIhkEeZ5xXmb'
Source: okilo[1].exe.2.dr, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	High entropy of concatenated method names: 'wTZaS0nBvA', 'TCNa7mT90D', 'C7sa9Heyhs', '.ctor', '.ctor', 'HvMakdf0Mv', 'RUJaehb7wV', 'hdta2bsLZX', 'UyyahGtghd', 'V2TQuv3O2GTfCCOhUOo'
Source: okilo[1].exe.2.dr, dFh6INFVpRyg1i1XS0/qAIrjXyqoofwXavk63.cs	High entropy of concatenated method names: '.ctor', 'RwOarlePvA', 'L1NamsEp4Q', 'tctaM9GGtw', 'bAXaOxs1nZ', 'D0FanqTD6a', 'TMXaWlJFKf', 'jgxaxDfADP', 'aqUagHR5bo', 'qa1avyK3VB'
Source: merciesxdncdc.exe.2.dr, TYrkToaGEMpjujrFga/prFipO63mgI0yvrVyq.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'T4ltQqiAVA', 'y5ALwKxnOC', 'SPFLlBsnwk', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'YDGLJl8xAQ'
Source: merciesxdncdc.exe.2.dr, ngYh84jGCP5wkphDFk5/yEIfrdj7Dt1Iw9K447j.cs	High entropy of concatenated method names: '.ctor', 'q9OaGjku7c', 'TJ7aAv00Et', 'f0jaDqJSk2', 'qBHaTNRD8W', 'xkNaQK4wah', 'rNpaw40VDI', 'CLMal09RDm', 'VSDaJ3xt4v', 'nGdazASDKU'
Source: merciesxdncdc.exe.2.dr, SxfIUXVJdgBjNDLFNB/AM2hB8Lor7USiIUZxs.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'vYjtFVkHe8', 'hSbFCsIf9U', 'VBYFGHvDmK', 'H6tFAkBj2Z', 'd1kFDWfdZN', 'L3LFTMp8Vp', 'QvMFQUJcSm', 'Xg0FwSp5eu'
Source: merciesxdncdc.exe.2.dr, LNBaGnEQA3vyBDvVVi/em9cs2DYHr6JrqXilP.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'r1dZFhqXD1', 'YUHZLREAL5', 'HqoZ5K4kGc', 'TeeZY8InhQ', 'QrFZrlH2LO', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl'
Source: merciesxdncdc.exe.2.dr, okG58OBUEjZS4DZJG8/c2esVpS6KesUCjCATw.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'bbJZhccJiR', 'WlYYiQ9SWm', 'N60YcfEWYd', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'fbB55WM1tB'
Source: merciesxdncdc.exe.2.dr, Q7gT9wnkWoJQtDsXhx/z2cKe65WbGPGIjxmwr.cs	High entropy of concatenated method names: 'GeLovehHWr', 'Fknosk0xkT', 'UkPo0qs5Tx', 'gW5oEr6ndm', 'Fnco8evmdm', 'KcsofG2qCq', 'bNZormYp4J', 'JyIoi8qVIn', 'V46omQE60N', 'IRnoIISvIs'
Source: merciesxdncdc.exe.2.dr, YIrq8QHhDSfadQYNKS/xKDYPZQDg30Ao09YpT.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'y7xNDvof1h', 'Q435Ja1njk', 'UkP5zqs5Tx', 'gW5Ybr6ndm', 'ET3Y4eM0Ov', 'FncYoevmdm', 'KcsYUG2qCq', 'JyIYt8qVIn'
Source: merciesxdncdc.exe.2.dr, Fa8VLXM23mORvR5dME/HCKUkDbh5y3OV2oc6A.cs	High entropy of concatenated method names: 'kfG46Gu61d', 'PTk4SqjEAg', 'fbB4eWM1tB', 'bqs422jkMh', 'HQR47fZ3vS', 'vXF494PUY4', 'kEZ4qjgk85', 'gvM41Y4HNO', 'GQJ4uSgJ1n', 'PjQ4K0TZCQ'
Source: merciesxdncdc.exe.2.dr, bu1iYZjjaajwEIC7Iup/w9PdenjqgpAPWgp9wL5.cs	High entropy of concatenated method names: 'Dispose', 'QskaBtjAuY', 'AFqaPB2YbE', 'tVtaXuZSEy', 'get_Text', 'set_Text', '.ctor', 'OnPaint', 'rUR0VgYEXKD42V8HKGP', 'Fp8bSFYlanUNiKPqvWL'
Source: merciesxdncdc.exe.2.dr, XcixWBkBVqsjcaY6KL/OFsmGHhgogBJuaQceU.cs	High entropy of concatenated method names: 'TBvUjS7lP8', 'Q4fUuNHHUD', 'KAFUylqVop', 'ChfU3RNQmq', 'xVFUPj7qNN', 'AGQUXMqKhN', 'jioUdE9HJL', 'J73URxXTnn', 'eJSUCUn5uo', 'd0UUGXJlsJ'
Source: merciesxdncdc.exe.2.dr, IHXFP9YcujtIe1fkv0/kTeD6mxEv4W0qYVQoh.cs	High entropy of concatenated method names: 'Q6RUMV6LIj', 'Oc1UOxefwD', 'ornUWFtLC6', 'hytUx6xd1I', 'L4NUv9v5d9', 'WP5UsWAMyC', 'ACsUplcTLj', 'xbdU0uPUah', 'rHFUE0Twv4', 'pAnUVksqey'
Source: merciesxdncdc.exe.2.dr, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	High entropy of concatenated method names: 'wTZaS0nBvA', 'TCNa7mT90D', 'C7sa9Heyhs', '.ctor', '.ctor', 'HvMakdf0Mv', 'RUJaehb7wV', 'hdta2bsLZX', 'UyyahGtghd', 'V2TQuv3O2GTfCCOhUOo'
Source: merciesxdncdc.exe.2.dr, edM23O9tYBo3W9lyds/OgdU2MJmnLuJrUAowu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'atTFyjqlwC', 'lriF3OBRwt', 'BreFBgaf10', 'KJ4FPKPpmT', 'zEfFXihnuJ', 'gcXFdvP77o', 'nAUFRaNNpm', 'JnrFHwJRTO'
Source: merciesxdncdc.exe.2.dr, xn2PL6Ay0FbgjDCQUf/UyLOepCdZDDnGoRbQD.cs	High entropy of concatenated method names: '.ctor', 'opga4Q0sxF', 'BItaorKZTM', 'pLAaUnwosb', 'uAhatLyxpT', 'RARaNRD0l6', 'K9oaZAurMg', 'XCK7Hf3gDDwBligG6BE', 'QhJb123S9cGrcrHo9qN', 'Mv0W6M3PIhkEeZ5xXmb'
Source: merciesxdncdc.exe.2.dr, dFh6INFVpRyg1i1XS0/qAIrjXyqoofwXavk63.cs	High entropy of concatenated method names: '.ctor', 'RwOarlePvA', 'L1NamsEp4Q', 'tctaM9GGtw', 'bAXaOxs1nZ', 'D0FanqTD6a', 'TMXaWlJFKf', 'jgxaxDfADP', 'aqUagHR5bo', 'qa1avyK3VB'
Source: JxCmQoa.exe.4.dr, TYrkToaGEMpjujrFga/prFipO63mgI0yvrVyq.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'T4ltQqiAVA', 'y5ALwKxnOC', 'SPFLlBsnwk', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'YDGLJl8xAQ'
Source: JxCmQoa.exe.4.dr, SxfIUXVJdgBjNDLFNB/AM2hB8Lor7USiIUZxs.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'vYjtFVkHe8', 'hSbFCsIf9U', 'VBYFGHvDmK', 'H6tFAkBj2Z', 'd1kFDWfdZN', 'L3LFTMp8Vp', 'QvMFQUJcSm', 'Xg0FwSp5eu'
Source: JxCmQoa.exe.4.dr, Q7gT9wnkWoJQtDsXhx/z2cKe65WbGPGIjxmwr.cs	High entropy of concatenated method names: 'GeLovehHWr', 'Fknosk0xkT', 'UkPo0qs5Tx', 'gW5oEr6ndm', 'Fnco8evmdm', 'KcsofG2qCq', 'bNZormYp4J', 'JyIoi8qVIn', 'V46omQE60N', 'IRnoIISvIs'
Source: JxCmQoa.exe.4.dr, LNBaGnEQA3vyBDvVVi/em9cs2DYHr6JrqXilP.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'r1dZFhqXD1', 'YUHZLREAL5', 'HqoZ5K4kGc', 'TeeZY8InhQ', 'QrFZrlH2LO', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl'
Source: JxCmQoa.exe.4.dr, YIrq8QHhDSfadQYNKS/xKDYPZQDg30Ao09YpT.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'y7xNDvof1h', 'Q435Ja1njk', 'UkP5zqs5Tx', 'gW5Ybr6ndm', 'ET3Y4eM0Ov', 'FncYoevmdm', 'KcsYUG2qCq', 'JyIYt8qVIn'
Source: JxCmQoa.exe.4.dr, edM23O9tYBo3W9lyds/OgdU2MJmnLuJrUAowu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'atTFyjqlwC', 'lriF3OBRwt', 'BreFBgaf10', 'KJ4FPKPpmT', 'zEfFXihnuJ', 'gcXFdvP77o', 'nAUFRaNNpm', 'JnrFHwJRTO'
Source: JxCmQoa.exe.4.dr, Fa8VLXM23mORvR5dME/HCKUkDbh5y3OV2oc6A.cs	High entropy of concatenated method names: 'kfG46Gu61d', 'PTk4SqjEAg', 'fbB4eWM1tB', 'bqs422jkMh', 'HQR47fZ3vS', 'vXF494PUY4', 'kEZ4qjgk85', 'gvM41Y4HNO', 'GQJ4uSgJ1n', 'PjQ4K0TZCQ'
Source: JxCmQoa.exe.4.dr, XcixWBkBVqsjcaY6KL/OFsmGHhgogBJuaQceU.cs	High entropy of concatenated method names: 'TBvUjS7lP8', 'Q4fUuNHHUD', 'KAFUylqVop', 'ChfU3RNQmq', 'xVFUPj7qNN', 'AGQUXMqKhN', 'jioUdE9HJL', 'J73URxXTnn', 'eJSUCUn5uo', 'd0UUGXJlsJ'
Source: JxCmQoa.exe.4.dr, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	High entropy of concatenated method names: 'wTZaS0nBvA', 'TCNa7mT90D', 'C7sa9Heyhs', '.ctor', '.ctor', 'HvMakdf0Mv', 'RUJaehb7wV', 'hdta2bsLZX', 'UyyahGtghd', 'V2TQuv3O2GTfCCOhUOo'
Source: JxCmQoa.exe.4.dr, xn2PL6Ay0FbgjDCQUf/UyLOepCdZDDnGoRbQD.cs	High entropy of concatenated method names: '.ctor', 'opga4Q0sxF', 'BItaorKZTM', 'pLAaUnwosb', 'uAhatLyxpT', 'RARaNRD0l6', 'K9oaZAurMg', 'XCK7Hf3gDDwBligG6BE', 'QhJb123S9cGrcrHo9qN', 'Mv0W6M3PIhkEeZ5xXmb'
Source: JxCmQoa.exe.4.dr, bu1iYZjjaajwEIC7Iup/w9PdenjqgpAPWgp9wL5.cs	High entropy of concatenated method names: 'Dispose', 'QskaBtjAuY', 'AFqaPB2YbE', 'tVtaXuZSEy', 'get_Text', 'set_Text', '.ctor', 'OnPaint', 'rUR0VgYEXKD42V8HKGP', 'Fp8bSFYlanUNiKPqvWL'
Source: JxCmQoa.exe.4.dr, IHXFP9YcujtIe1fkv0/kTeD6mxEv4W0qYVQoh.cs	High entropy of concatenated method names: 'Q6RUMV6LIj', 'Oc1UOxefwD', 'ornUWFtLC6', 'hytUx6xd1I', 'L4NUv9v5d9', 'WP5UsWAMyC', 'ACsUplcTLj', 'xbdU0uPUah', 'rHFUE0Twv4', 'pAnUVksqey'
Source: JxCmQoa.exe.4.dr, dFh6INFVpRyg1i1XS0/qAIrjXyqoofwXavk63.cs	High entropy of concatenated method names: '.ctor', 'RwOarlePvA', 'L1NamsEp4Q', 'tctaM9GGtw', 'bAXaOxs1nZ', 'D0FanqTD6a', 'TMXaWlJFKf', 'jgxaxDfADP', 'aqUagHR5bo', 'qa1avyK3VB'
Source: JxCmQoa.exe.4.dr, ngYh84jGCP5wkphDFk5/yEIfrdj7Dt1Iw9K447j.cs	High entropy of concatenated method names: '.ctor', 'q9OaGjku7c', 'TJ7aAv00Et', 'f0jaDqJSk2', 'qBHaTNRD8W', 'xkNaQK4wah', 'rNpaw40VDI', 'CLMal09RDm', 'VSDaJ3xt4v', 'nGdazASDKU'
Source: JxCmQoa.exe.4.dr, okG58OBUEjZS4DZJG8/c2esVpS6KesUCjCATw.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'bbJZhccJiR', 'WlYYiQ9SWm', 'N60YcfEWYd', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'fbB55WM1tB'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, TYrkToaGEMpjujrFga/prFipO63mgI0yvrVyq.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'T4ltQqiAVA', 'y5ALwKxnOC', 'SPFLlBsnwk', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'YDGLJl8xAQ'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, SxfIUXVJdgBjNDLFNB/AM2hB8Lor7USiIUZxs.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'vYjtFVkHe8', 'hSbFCsIf9U', 'VBYFGHvDmK', 'H6tFAkBj2Z', 'd1kFDWfdZN', 'L3LFTMp8Vp', 'QvMFQUJcSm', 'Xg0FwSp5eu'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, ngYh84jGCP5wkphDFk5/yEIfrdj7Dt1Iw9K447j.cs	High entropy of concatenated method names: '.ctor', 'q9OaGjku7c', 'TJ7aAv00Et', 'f0jaDqJSk2', 'qBHaTNRD8W', 'xkNaQK4wah', 'rNpaw40VDI', 'CLMal09RDm', 'VSDaJ3xt4v', 'nGdazASDKU'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, Q7gT9wnkWoJQtDsXhx/z2cKe65WbGPGIjxmwr.cs	High entropy of concatenated method names: 'GeLovehHWr', 'Fknosk0xkT', 'UkPo0qs5Tx', 'gW5oEr6ndm', 'Fnco8evmdm', 'KcsofG2qCq', 'bNZormYp4J', 'JyIoi8qVIn', 'V46omQE60N', 'IRnoIISvIs'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, LNBaGnEQA3vyBDvVVi/em9cs2DYHr6JrqXilP.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'r1dZFhqXD1', 'YUHZLREAL5', 'HqoZ5K4kGc', 'TeeZY8InhQ', 'QrFZrlH2LO', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, okG58OBUEjZS4DZJG8/c2esVpS6KesUCjCATw.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'bbJZhccJiR', 'WlYYiQ9SWm', 'N60YcfEWYd', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'fbB55WM1tB'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, YIrq8QHhDSfadQYNKS/xKDYPZQDg30Ao09YpT.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'y7xNDvof1h', 'Q435Ja1njk', 'UkP5zqs5Tx', 'gW5Ybr6ndm', 'ET3Y4eM0Ov', 'FncYoevmdm', 'KcsYUG2qCq', 'JyIYt8qVIn'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, Fa8VLXM23mORvR5dME/HCKUkDbh5y3OV2oc6A.cs	High entropy of concatenated method names: 'kfG46Gu61d', 'PTk4SqjEAg', 'fbB4eWM1tB', 'bqs422jkMh', 'HQR47fZ3vS', 'vXF494PUY4', 'kEZ4qjgk85', 'gvM41Y4HNO', 'GQJ4uSgJ1n', 'PjQ4K0TZCQ'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, XcixWBkBVqsjcaY6KL/OFsmGHhgogBJuaQceU.cs	High entropy of concatenated method names: 'TBvUjS7lP8', 'Q4fUuNHHUD', 'KAFUylqVop', 'ChfU3RNQmq', 'xVFUPj7qNN', 'AGQUXMqKhN', 'jioUdE9HJL', 'J73URxXTnn', 'eJSUCUn5uo', 'd0UUGXJlsJ'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, edM23O9tYBo3W9lyds/OgdU2MJmnLuJrUAowu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'atTFyjqlwC', 'lriF3OBRwt', 'BreFBgaf10', 'KJ4FPKPpmT', 'zEfFXihnuJ', 'gcXFdvP77o', 'nAUFRaNNpm', 'JnrFHwJRTO'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	High entropy of concatenated method names: 'wTZaS0nBvA', 'TCNa7mT90D', 'C7sa9Heyhs', '.ctor', '.ctor', 'HvMakdf0Mv', 'RUJaehb7wV', 'hdta2bsLZX', 'UyyahGtghd', 'V2TQuv3O2GTfCCOhUOo'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, IHXFP9YcujtIe1fkv0/kTeD6mxEv4W0qYVQoh.cs	High entropy of concatenated method names: 'Q6RUMV6LIj', 'Oc1UOxefwD', 'ornUWFtLC6', 'hytUx6xd1I', 'L4NUv9v5d9', 'WP5UsWAMyC', 'ACsUplcTLj', 'xbdU0uPUah', 'rHFUE0Twv4', 'pAnUVksqey'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, bu1iYZjjaajwEIC7Iup/w9PdenjqgpAPWgp9wL5.cs	High entropy of concatenated method names: 'Dispose', 'QskaBtjAuY', 'AFqaPB2YbE', 'tVtaXuZSEy', 'get_Text', 'set_Text', '.ctor', 'OnPaint', 'rUR0VgYEXKD42V8HKGP', 'Fp8bSFYlanUNiKPqvWL'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, xn2PL6Ay0FbgjDCQUf/UyLOepCdZDDnGoRbQD.cs	High entropy of concatenated method names: '.ctor', 'opga4Q0sxF', 'BItaorKZTM', 'pLAaUnwosb', 'uAhatLyxpT', 'RARaNRD0l6', 'K9oaZAurMg', 'XCK7Hf3gDDwBligG6BE', 'QhJb123S9cGrcrHo9qN', 'Mv0W6M3PIhkEeZ5xXmb'
Source: 4.0.merciesxdncdc.exe.9d0000.0.unpack, dFh6INFVpRyg1i1XS0/qAIrjXyqoofwXavk63.cs	High entropy of concatenated method names: '.ctor', 'RwOarlePvA', 'L1NamsEp4Q', 'tctaM9GGtw', 'bAXaOxs1nZ', 'D0FanqTD6a', 'TMXaWlJFKf', 'jgxaxDfADP', 'aqUagHR5bo', 'qa1avyK3VB'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, TYrkToaGEMpjujrFga/prFipO63mgI0yvrVyq.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'T4ltQqiAVA', 'y5ALwKxnOC', 'SPFLlBsnwk', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'YDGLJl8xAQ'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, SxfIUXVJdgBjNDLFNB/AM2hB8Lor7USiIUZxs.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'vYjtFVkHe8', 'hSbFCsIf9U', 'VBYFGHvDmK', 'H6tFAkBj2Z', 'd1kFDWfdZN', 'L3LFTMp8Vp', 'QvMFQUJcSm', 'Xg0FwSp5eu'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, Q7gT9wnkWoJQtDsXhx/z2cKe65WbGPGIjxmwr.cs	High entropy of concatenated method names: 'GeLovehHWr', 'Fknosk0xkT', 'UkPo0qs5Tx', 'gW5oEr6ndm', 'Fnco8evmdm', 'KcsofG2qCq', 'bNZormYp4J', 'JyIoi8qVIn', 'V46omQE60N', 'IRnoIISvIs'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, LNBaGnEQA3vyBDvVVi/em9cs2DYHr6JrqXilP.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'r1dZFhqXD1', 'YUHZLREAL5', 'HqoZ5K4kGc', 'TeeZY8InhQ', 'QrFZrlH2LO', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, okG58OBUEjZS4DZJG8/c2esVpS6KesUCjCATw.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'bbJZhccJiR', 'WlYYiQ9SWm', 'N60YcfEWYd', 'g2XLMABbM1', 'nscLOcnG4I', 'E7dLn5AIMl', 'Q5eLWq4DlT', 'fbB55WM1tB'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, YIrq8QHhDSfadQYNKS/xKDYPZQDg30Ao09YpT.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'y7xNDvof1h', 'Q435Ja1njk', 'UkP5zqs5Tx', 'gW5Ybr6ndm', 'ET3Y4eM0Ov', 'FncYoevmdm', 'KcsYUG2qCq', 'JyIYt8qVIn'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, Fa8VLXM23mORvR5dME/HCKUkDbh5y3OV2oc6A.cs	High entropy of concatenated method names: 'kfG46Gu61d', 'PTk4SqjEAg', 'fbB4eWM1tB', 'bqs422jkMh', 'HQR47fZ3vS', 'vXF494PUY4', 'kEZ4qjgk85', 'gvM41Y4HNO', 'GQJ4uSgJ1n', 'PjQ4K0TZCQ'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, XcixWBkBVqsjcaY6KL/OFsmGHhgogBJuaQceU.cs	High entropy of concatenated method names: 'TBvUjS7lP8', 'Q4fUuNHHUD', 'KAFUylqVop', 'ChfU3RNQmq', 'xVFUPj7qNN', 'AGQUXMqKhN', 'jioUdE9HJL', 'J73URxXTnn', 'eJSUCUn5uo', 'd0UUGXJlsJ'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, edM23O9tYBo3W9lyds/OgdU2MJmnLuJrUAowu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'atTFyjqlwC', 'lriF3OBRwt', 'BreFBgaf10', 'KJ4FPKPpmT', 'zEfFXihnuJ', 'gcXFdvP77o', 'nAUFRaNNpm', 'JnrFHwJRTO'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, aXR39HWJ4x0q7MGLxy/O957nfmxJOySU8vkRf.cs	High entropy of concatenated method names: 'wTZaS0nBvA', 'TCNa7mT90D', 'C7sa9Heyhs', '.ctor', '.ctor', 'HvMakdf0Mv', 'RUJaehb7wV', 'hdta2bsLZX', 'UyyahGtghd', 'V2TQuv3O2GTfCCOhUOo'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, IHXFP9YcujtIe1fkv0/kTeD6mxEv4W0qYVQoh.cs	High entropy of concatenated method names: 'Q6RUMV6LIj', 'Oc1UOxefwD', 'ornUWFtLC6', 'hytUx6xd1I', 'L4NUv9v5d9', 'WP5UsWAMyC', 'ACsUplcTLj', 'xbdU0uPUah', 'rHFUE0Twv4', 'pAnUVksqey'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, xn2PL6Ay0FbgjDCQUf/UyLOepCdZDDnGoRbQD.cs	High entropy of concatenated method names: '.ctor', 'opga4Q0sxF', 'BItaorKZTM', 'pLAaUnwosb', 'uAhatLyxpT', 'RARaNRD0l6', 'K9oaZAurMg', 'XCK7Hf3gDDwBligG6BE', 'QhJb123S9cGrcrHo9qN', 'Mv0W6M3PIhkEeZ5xXmb'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, dFh6INFVpRyg1i1XS0/qAIrjXyqoofwXavk63.cs	High entropy of concatenated method names: '.ctor', 'RwOarlePvA', 'L1NamsEp4Q', 'tctaM9GGtw', 'bAXaOxs1nZ', 'D0FanqTD6a', 'TMXaWlJFKf', 'jgxaxDfADP', 'aqUagHR5bo', 'qa1avyK3VB'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, ngYh84jGCP5wkphDFk5/yEIfrdj7Dt1Iw9K447j.cs	High entropy of concatenated method names: '.ctor', 'q9OaGjku7c', 'TJ7aAv00Et', 'f0jaDqJSk2', 'qBHaTNRD8W', 'xkNaQK4wah', 'rNpaw40VDI', 'CLMal09RDm', 'VSDaJ3xt4v', 'nGdazASDKU'
Source: 7.2.merciesxdncdc.exe.9d0000.1.unpack, bu1iYZjjaajwEIC7Iup/w9PdenjqgpAPWgp9wL5.cs	High entropy of concatenated method names: 'Dispose', 'QskaBtjAuY', 'AFqaPB2YbE', 'tVtaXuZSEy', 'get_Text', 'set_Text', '.ctor', 'OnPaint', 'rUR0VgYEXKD42V8HKGP', 'Fp8bSFYlanUNiKPqvWL'

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2804	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2804	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 2188	Thread sleep time: -47836s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 2188	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 3016	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 2276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 1916	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 2488	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe TID: 2488	Thread sleep time: -150000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 47836	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: merciesxdncdc.exe, 00000007.00000002.2346712504.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: merciesxdncdc.exe, 00000007.00000002.2346712504.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: merciesxdncdc.exe, 00000007.00000002.2346712504.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Queries volume information: C:\Users\user\AppData\Roaming\merciesxdncdc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Queries volume information: C:\Users\user\AppData\Roaming\merciesxdncdc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior

Windows Analysis Report PAYMENT ADVICE.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: Yara match	File source: 7.2.merciesxdncdc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2346238680.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\merciesxdncdc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Source: Yara match	File source: 00000007.00000002.2347741002.00000000028A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2347049705.0000000002461000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2347184343.000000000250A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: merciesxdncdc.exe PID: 2728, type: MEMORY

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.27.166	maritradeshipplng.com	United States		13335	CLOUDFLARENETUS	true
198.54.122.60	mail.privateemail.com	United States		22612	NAMECHEAP-NETUS	false

ID:	452655
Product:	CloudBasic
Start time:	17:29:58
Start date:	22.07.2021
Sample:	PAYMENT ADVICE.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	71af183490ef5c747eb3b6a1417c8f33
SHA1:	cbf5c744909fb1978d8bbadb3b1377e7b364f90d
SHA256:	fd1d1d4f70fb3b258e798ba9ac66abd6ad9d9de16b4b2204f55519ea59eb7d12
Filetype:	Rich Text Format (5005/1) 55.56%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 61020 bytes, 1 file	2902DE11E30DCC620B184E3BB0F0C1CB	5D11D14A2558801A2688DC2D6DFAD39AC294F222	E6A7F1F8810E46A736E80EE5AC6187690F28F4D5D35D130D410E20084B2C1544
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	9B5941799D0326F5D38F79BAFF58369B	E636D57049B73BA03C807374AE7141E2251A7953	16B2D9650A740EF9EBA55FE991AE95F716BAF0DBB3B94A30429D9CD3CBF02CDD
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\okilo[1].exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	E85A0E1E81ACBCEA6A0E10EEEDF32F6D	3C613A4D232645CCCBC7C1D8A3A8AFB54CD2D56C	AE7399822AD5EF4D9BD2690DF74F6F1B472103380BE74FCA33611CE7265EBC01
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7621A4C2-B642-4F8D-8632-93AA6D767CE8}.tmp	data	A0992BC512D99AC859A0EF0FDE87A283	978E5F05BFF696D3579CBFCBE869CC586F723A21	1947CED15B6C19F1F910A911FBC3BFB77ABD80B441D029FE60C2DFB0E4B6850F
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B5F1B80B-61BE-41BF-89DB-AF92964D1C77}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Temp\Cab1C98.tmp	Microsoft Cabinet archive data, 61020 bytes, 1 file	2902DE11E30DCC620B184E3BB0F0C1CB	5D11D14A2558801A2688DC2D6DFAD39AC294F222	E6A7F1F8810E46A736E80EE5AC6187690F28F4D5D35D130D410E20084B2C1544
C:\Users\user\AppData\Local\Temp\Tar1C99.tmp	data	E4731F8A3E7352DBA44EC7D3DD15BAEA	D5CA0025FBD356DEB8EDE35001F93039625562A5	6C78EF77ACEF978321CCD30EE126FB7D30285BC186DDBDBE8B3E8F6E69D01353
C:\Users\user\AppData\Local\Temp\tmp2E52.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	70A159A3BAD5639BFBC4FB11D77059B7	233D04B3ACAF4ED93FF029B11099CE048A0376B5	7FB966A4E0F49D41ECE7FEA26CB4AEF90466119D8F00C84E0195D5F5AACC3880
C:\Users\user\AppData\Roaming\1ht4xmev.key\Chrome\Default\Cookies	SQLite 3.x database, last written using SQLite version 3032001	903C35B27A5774A639A90D5332EEF8E0	5A8CE0B6C13D1AF00837AA6CA1AA39000D4EB7CF	1159B5AE357F89C56FA23C14378FF728251E6BDE6EEA979F528DB11C4030BE74
C:\Users\user\AppData\Roaming\1ht4xmev.key\Firefox\Profiles\7xwghk55.default\cookies.sqlite	SQLite 3.x database, user version 7, last written using SQLite version 3017000	1138F6578C48F43C5597EE203AFF5B27	9B55D0A511E7348E507D818B93F1C99986D33E7B	EEEDF71E8E9A3A048022978336CA89A30E014AE481E73EF5011071462343FFBF
C:\Users\user\AppData\Roaming\JxCmQoa.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	E85A0E1E81ACBCEA6A0E10EEEDF32F6D	3C613A4D232645CCCBC7C1D8A3A8AFB54CD2D56C	AE7399822AD5EF4D9BD2690DF74F6F1B472103380BE74FCA33611CE7265EBC01
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PAYMENT ADVICE.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed Aug 26 14:08:16 2020, atime=Thu Jul 22 23:30:34 2021, length=4547, window=hide	E07040CE2E1AB565DEA33B6137C4F158	854E081D9152EB535A0398506966A7E38DFC3D99	EDA2AD4E4EC04F2A59192A7695D7B5FBE167F30DDC9711FDD6C6E3A7372E7ED6
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	A09DEABB3E8DDD44DB8D4057AE8690F3	67FD33C2F0245E33C3E9BD53CB5DB26BF3FED334	514B4256FBDA9C731E7FC89315FBD71DB3533B8DC3EDB6A3554B40E4D3CD144C
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	390880DCFAA790037FA37F50A7080387	760940B899B1DC961633242DB5FF170A0522B0A5	BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
C:\Users\user\AppData\Roaming\merciesxdncdc.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	E85A0E1E81ACBCEA6A0E10EEEDF32F6D	3C613A4D232645CCCBC7C1D8A3A8AFB54CD2D56C	AE7399822AD5EF4D9BD2690DF74F6F1B472103380BE74FCA33611CE7265EBC01
C:\Users\user\Desktop\~$YMENT ADVICE.doc	data	390880DCFAA790037FA37F50A7080387	760940B899B1DC961633242DB5FF170A0522B0A5	BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391