Windows Analysis Report
#U8f6e#U6905-#U89c4#U683c.docx.pif.exe

Overview

General Information

Sample name: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
renamed because original name is a hash value
Original sample name: -.docx.pif.exe
Analysis ID: 1466661
MD5: a048afa687356f7d1b0fc9375ca13d06
SHA1: ec3f1158191496c89ce09ccb1dc699278b2a506a
SHA256: f0ec07e537c7bf74abbc66af82e1f273fceca81467e1d74ed69514107421de61
Tags: exepif
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Opens the same file many times (likely Sandbox evasion)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Antivirus detection for URL or domain
Source: www.vipguyclassproject2024.space Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "www.vipguyclassproject2024.space:2404:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-5MRRQ3", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Virustotal: Detection: 60% Perma Link
Multi AV Scanner detection for submitted file
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe ReversingLabs: Detection: 65%
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Virustotal: Detection: 60% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2107662526.00000000054E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\gaban\logs.dat, type: DROPPED
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 15_2_00433837
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_e6f7eea8-2

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR

Privilege Escalation
barindex
Contains functionality to bypass UAC (CMSTPLUA)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004074FD _wcslen,CoGetObject, 15_2_004074FD
Uses 32bit PE files
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 15_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 15_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 15_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 15_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0044E879 FindFirstFileExA, 15_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 15_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040783C FindFirstFileW,FindNextFileW, 15_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, 15_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 15_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 15_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 15_2_00407C97
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 4x nop then jmp 0476A92Eh 0_2_0476AC62
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 4x nop then jmp 04AE9BBEh 10_2_04AE9EF2

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.vipguyclassproject2024.space
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: www.vipguyclassproject2024.space replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 15_2_0041B380
Source: global traffic DNS traffic detected: DNS query: www.vipguyclassproject2024.space
Source: vbc.exe String found in binary or memory: http://geoplugin.net/json.gp
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, TkdxROLUOVpK.exe, 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2091740507.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, TkdxROLUOVpK.exe, 0000000A.00000002.2127357772.0000000002A61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000 15_2_0040A2B8
Installs a global keyboard hook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard, 15_2_0040B70E
Contains functionality to modify clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 15_2_004168C1
Contains functionality to read the clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard, 15_2_0040B70E
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx, 15_2_0040A3E0

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2107662526.00000000054E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\gaban\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands
barindex
Contains functionalty to change the wallpaper
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041C9E2 SystemParametersInfoW, 15_2_0041C9E2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
.NET source code contains very large array initializations
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.7570000.8.raw.unpack, -Module-.cs Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
Abnormal high CPU Usage
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process Stats: CPU usage > 49%
Contains functionality to shutdown / reboot the system
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress, 15_2_004167B4
Detected potential crypto function
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0270D4FC 0_2_0270D4FC
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_04766420 0_2_04766420
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_047644D8 0_2_047644D8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_04764D48 0_2_04764D48
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0476C6B8 0_2_0476C6B8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_04765FE8 0_2_04765FE8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_04764910 0_2_04764910
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_04764900 0_2_04764900
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_06AEBD00 0_2_06AEBD00
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_06AEC747 0_2_06AEC747
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_06AE935C 0_2_06AE935C
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_06AE0040 0_2_06AE0040
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075607C8 0_2_075607C8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0756DA88 0_2_0756DA88
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075669F0 0_2_075669F0
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075651E8 0_2_075651E8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07569039 0_2_07569039
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075638D6 0_2_075638D6
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07567E40 0_2_07567E40
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07567E39 0_2_07567E39
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07567D18 0_2_07567D18
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07567D09 0_2_07567D09
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0756CC78 0_2_0756CC78
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07564A7C 0_2_07564A7C
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0756D228 0_2_0756D228
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075672F8 0_2_075672F8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075672EA 0_2_075672EA
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075691DB 0_2_075691DB
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075669EA 0_2_075669EA
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_075669AA 0_2_075669AA
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_012AD4FC 10_2_012AD4FC
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_04AE44D8 10_2_04AE44D8
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_04AE6420 10_2_04AE6420
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_04AE4D48 10_2_04AE4D48
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_04AE5FE8 10_2_04AE5FE8
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_04AE4910 10_2_04AE4910
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Code function: 10_2_04AEBA00 10_2_04AEBA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0043E0CC 15_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041F0FA 15_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00454159 15_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00438168 15_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004461F0 15_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0043E2FB 15_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0045332B 15_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0042739D 15_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004374E6 15_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0043E558 15_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00438770 15_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004378FE 15_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00433946 15_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0044D9C9 15_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00427A46 15_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041DB62 15_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00427BAF 15_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00437D33 15_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00435E5E 15_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00426E0E 15_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0043DE9D 15_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00413FCA 15_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00436FEA 15_2_00436FEA
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: String function: 00401E65 appears 34 times
Sample file is different than original file name gathered from version info
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2097614968.0000000007570000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameRT.dll. vs #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2090587002.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2097704677.00000000075FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXEj% vs #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000002.2097030538.0000000006E30000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe, 00000000.00000000.2042879669.00000000004BA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameznIq.exe0 vs #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Binary or memory string: OriginalFilenameznIq.exe0 vs #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Uses 32bit PE files
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TkdxROLUOVpK.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.SetAccessControl
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.AddAccessRule
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.SetAccessControl
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.AddAccessRule
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, PenYE0tkOYCLDqwRMy.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.SetAccessControl
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.AddAccessRule
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, PenYE0tkOYCLDqwRMy.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.SetAccessControl
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, YL2q2YAVtmpvhXuwY3.cs Security API names: _0020.AddAccessRule
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, PenYE0tkOYCLDqwRMy.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, PenYE0tkOYCLDqwRMy.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@21/16@51/0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 15_2_00417952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle, 15_2_0040F474
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource, 15_2_0041B4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 15_2_0041AA4A
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe File created: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-5MRRQ3
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4672:120:WilError_03
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_03
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Mutant created: \Sessions\1\BaseNamedObjects\GZHBuduAufzLXXIAj
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe File created: C:\Users\user\AppData\Local\Temp\tmpBE91.tmp Jump to behavior
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe ReversingLabs: Detection: 65%
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Virustotal: Detection: 60%
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe File read: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe"
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpBE91.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpCDF3.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpBE91.tmp" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpCDF3.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, YL2q2YAVtmpvhXuwY3.cs .Net Code: sgZHeKVbHo System.Reflection.Assembly.Load(byte[])
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs .Net Code: sgZHeKVbHo System.Reflection.Assembly.Load(byte[])
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, YL2q2YAVtmpvhXuwY3.cs .Net Code: sgZHeKVbHo System.Reflection.Assembly.Load(byte[])
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.7570000.8.raw.unpack, -Module-.cs .Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.7570000.8.raw.unpack, PingPong.cs .Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs .Net Code: sgZHeKVbHo System.Reflection.Assembly.Load(byte[])
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 15_2_0041CB50
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_02704659 push edx; retf 0_2_0270465A
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_02704699 push edx; retf 0_2_0270469A
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0270469B push edx; retf 0_2_0270469E
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0270469F push edx; retf 0_2_027046A2
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_02704759 push ebp; retf 0_2_0270475A
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0270475B push ebp; retf 0_2_02704762
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_02704791 push esi; retf 0_2_02704792
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_0270ABE0 pushfd ; retf 0_2_0270ABE2
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_06AE4A9F push C3037447h; ret 0_2_06AE4AC4
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Code function: 0_2_07568049 push 8BBCEB50h; ret 0_2_0756804F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00457106 push ecx; ret 15_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0045B11A push esp; ret 15_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0045E54D push esi; ret 15_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00457A28 push eax; ret 15_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00434E56 push ecx; ret 15_2_00434E69
Source: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe Static PE information: section name: .text entropy: 7.988838794549899
Source: TkdxROLUOVpK.exe.0.dr Static PE information: section name: .text entropy: 7.988838794549899
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, oxcyjc1LDHjoCrebX9.cs High entropy of concatenated method names: 'CpeFZUsOAK', 'ffWFT0XXQ8', 'cRvFt9btKt', 'zT9F1vSx30', 'TpJF76fsMy', 'h1bFSO0WEQ', 'vVUFCJYFHA', 'bhhFytBCp0', 'u0kFmVGkif', 'C9MF9meTA7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, mtvXm3uIEAO1aOMiyD.cs High entropy of concatenated method names: 'c0milBFjFK', 'hTOiWMHxTV', 'AsPinGlJIO', 'g1uiar8qjC', 'NZxiAZVchj', 'GD0n0QGOqE', 'qIhn4jjovH', 'N9DnGh5vjd', 'HudnjUsN51', 'qHwnBQoRpn'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, wOvN8bjY05qG3h2W8d.cs High entropy of concatenated method names: 'Sr6ygxiaYx', 'rwfyWo1LHn', 'J3yyFIWqgs', 'prAynrpD0X', 'KMDyiBaq2C', 'skMyasn07F', 'oLiyAycMAm', 'qu2yOwgwf7', 'd5fyxlQnuc', 'KIvyoQ4EBQ'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, YL2q2YAVtmpvhXuwY3.cs High entropy of concatenated method names: 'nGjdlidUc5', 'BEOdgtBWR3', 'f3EdWwfCY8', 'k00dF4aMpe', 'XCAdnpjDT0', 'mLgdih6Yrv', 'qZrdaV1W46', 'TFDdAmRVJh', 'DsmdOvsiU7', 'xW9dxCCdBM'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, PenYE0tkOYCLDqwRMy.cs High entropy of concatenated method names: 'OZ2WqovcLY', 'W6EWpoJ0FP', 'YDNWLn2lWn', 'S5DWkwfnRL', 'HxhW098Ls7', 'cd8W4UiHtJ', 'lEnWGZAEua', 'nWyWjpUK0y', 'Lk5WBYBomk', 'faJWv5feyx'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, DWbfV733wDM7SoPHEF6.cs High entropy of concatenated method names: 'ToString', 'yf59dP2XpZ', 'bUX9H0j1dF', 'v4l9l26UMr', 'qWM9ghK2xI', 'asS9WUxQg4', 'ioo9Frw13P', 'GJF9n3jBEw', 'Ptm8aGGrnB507pBDKR0', 'cCPRQuGGl0M7NqkkF6P'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, qKcUIQWYkr2kHlVcDF.cs High entropy of concatenated method names: 'Dispose', 'FMN3B1onPs', 'aBvKN0TurG', 'RonttfPa2y', 'xXO3vvN8bY', 'U5q3zG3h2W', 'ProcessDialogKey', 'BdbKYqQ9hF', 'Sg8K35nfpH', 'SYgKKgspkO'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, v0UVJv4Fuk8ZSL2f7F.cs High entropy of concatenated method names: 'ADTCjxTKwn', 'AxCCvrCUPZ', 'gbiyY7k1ll', 'P8Sy3rvXf6', 'WIqCJCqSkS', 'xg4CIc3Ebq', 'K4JCwhA34c', 'zIOCq3LxMo', 'SybCpGX2uA', 'yQgCLHIsRV'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, ALpl925dRu9MqQXKDu.cs High entropy of concatenated method names: 'oIwiLLvTPx', 'DPPik0p32Z', 'UBji0ZAewF', 'ToString', 'UVPi4hnMHU', 'cuMiGGoli3', 'TYugPnwIkXNdX6d0qcq', 'iMScspwfwXoIf5qeD4r', 'uRnOqOwmsq7sFZfWfJA', 'jIq298wgC0fl9F1MINd'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, fJAQuF3YIVEeN8MhNPj.cs High entropy of concatenated method names: 'mVQmVGrnR1', 'SAcmRDBpb4', 'VJHmehkTYa', 'wALmZg41J8', 'l03m8bMRp3', 'TfymTpkQnB', 'eQ5mbW1sDA', 'bAfmtTOLXs', 'JNxm1sSiNM', 'yZRmECQ6Eo'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, icvX8XzjLawXkxgs9u.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jjMmMwHhTW', 'Aqvm7r0f0G', 'gVsmS14DUf', 'ENtmCIbPXV', 'mV7myWetvB', 'HiXmmtg9SP', 'khGm9XRUjO'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, EyMqHCPs9E9FenpsLm.cs High entropy of concatenated method names: 'xvBagsCXW4', 'J7raFH66Eq', 'kP5aiVR3wa', 'QV9ivkLh0v', 'nTSiz5yecs', 'fNAaYUDGxS', 'IMma3TLuYM', 'SYCaKj6rdg', 'YufadClNQk', 'bh8aHJeSs7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, sXXw773dDD510lc6jEC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PGK9qQkYUJ', 'wEg9pijEGS', 'heX9LhSSuN', 'mjg9kJ5mtE', 'pUP90e6fmX', 'wJ794VXkGu', 'ySc9G2eFjM'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, DqQ9hFBLg85nfpHLYg.cs High entropy of concatenated method names: 'UEKyuBooGO', 'zHfyNtb4tI', 'pKvyQ9sLPA', 'dmiyhubaq7', 'X7qyqZp5UG', 'yoXy6FA4ph', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, xOjHSwE9BsL66jh6xb.cs High entropy of concatenated method names: 'WhBn8QlguT', 'I6nnbLN2Vn', 'd74FQsRJUf', 'm6rFhsgGx8', 'qCmF67MAsI', 'bGYF5sTXdw', 'upQFP9ndev', 'fOMFrQi4jm', 'gSOF2TIhRs', 'EALFs1EVqK'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, spQoUaHnJ5qLMKORun.cs High entropy of concatenated method names: 'mcI3aenYE0', 'TOY3ACLDqw', 'xLD3xHjoCr', 'zbX3o9VOjH', 'Wh637xbotv', 'wm33SIEAO1', 'J7x1FueM0GLDd6eQnJ', 'KWGbqQbychIN9Ffyr3', 'wJw33b2NCf', 'z4m3d0066t'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, SiNRcVkQKnvrVZtVoQ.cs High entropy of concatenated method names: 'wM1CxvY9Hs', 'oDwCoQd8vo', 'ToString', 'pjrCgXAEu3', 'OW5CWIiYmK', 'gAOCFcjJSm', 'VjWCnh6dhi', 'TK4CieaxFB', 'kbMCaJUjQy', 'LHgCAXEZCU'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, xo5PZY2ot5o5nvQbi0.cs High entropy of concatenated method names: 'eaXaVV6l9r', 'AZmaRmIx87', 'VVwaeXiXiX', 'eudaZIRScA', 'H8va8iWjmv', 'FsyaTgpsXj', 'S5uab8LvLP', 'clSatNDI7e', 'gnka17QghX', 'gNXaEDiCyV'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, RdIWAaqWmQBYJZJocJ.cs High entropy of concatenated method names: 'v0j7svN4HF', 'dSZ7IY9GTv', 'DYn7qGJLat', 'nBa7phdhlR', 'kwv7NeB87C', 'egY7QhGgvq', 'JwT7h6SR7W', 'BGn76kVla3', 'rba75e67Dn', 'mVO7PCbnyJ'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, fspkOWvogMOU36TAoN.cs High entropy of concatenated method names: 'tAFm3abwfM', 'MdQmd7WPix', 'zKXmHgWhfm', 'BtgmgIq9iP', 'HBwmWhy1lP', 'nLUmnbxyYJ', 'LMimiFeyPP', 'dK1yGqRw0L', 'gr8yjHqQF7', 'KAuyB7pl29'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, s1uhC0LTpfAvYaiZjt.cs High entropy of concatenated method names: 'ToString', 'TaSSJOUJdB', 'dToSNfMl8Q', 'hy7SQ70x57', 'jWAShpYpHZ', 'RwDS6eNviQ', 'Ts3S5WRtih', 'QIDSPoU7gc', 'TN6SrEtM3L', 'o9KS2mg7Nm'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, SgBrdEKGapRfKEKkNh.cs High entropy of concatenated method names: 'b5WeuaXnF', 'YjHZGiX7Y', 'R7BTVxfZk', 'FGHbPNuMS', 'KZY1JCQnM', 'XSrEqPofF', 'vKfgkcD8PCy0jh8eIi', 'NfIKNlCuym4prw6cmX', 'XMmyUUe55', 'OmA9Y4kE7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.6e30000.7.raw.unpack, OpOgmCw6PPUf8olH7e.cs High entropy of concatenated method names: 'lCSMt1g6rh', 'uxyM11trDN', 'MRpMukmKFN', 'Y28MNRm8OM', 'oK3MhnWw5x', 'd6iM60vqO1', 'ApuMPNwdt1', 'bBZMr7DNuO', 'EHGMsZAr8Q', 'DYtMJObaU1'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, oxcyjc1LDHjoCrebX9.cs High entropy of concatenated method names: 'CpeFZUsOAK', 'ffWFT0XXQ8', 'cRvFt9btKt', 'zT9F1vSx30', 'TpJF76fsMy', 'h1bFSO0WEQ', 'vVUFCJYFHA', 'bhhFytBCp0', 'u0kFmVGkif', 'C9MF9meTA7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, mtvXm3uIEAO1aOMiyD.cs High entropy of concatenated method names: 'c0milBFjFK', 'hTOiWMHxTV', 'AsPinGlJIO', 'g1uiar8qjC', 'NZxiAZVchj', 'GD0n0QGOqE', 'qIhn4jjovH', 'N9DnGh5vjd', 'HudnjUsN51', 'qHwnBQoRpn'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, wOvN8bjY05qG3h2W8d.cs High entropy of concatenated method names: 'Sr6ygxiaYx', 'rwfyWo1LHn', 'J3yyFIWqgs', 'prAynrpD0X', 'KMDyiBaq2C', 'skMyasn07F', 'oLiyAycMAm', 'qu2yOwgwf7', 'd5fyxlQnuc', 'KIvyoQ4EBQ'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs High entropy of concatenated method names: 'nGjdlidUc5', 'BEOdgtBWR3', 'f3EdWwfCY8', 'k00dF4aMpe', 'XCAdnpjDT0', 'mLgdih6Yrv', 'qZrdaV1W46', 'TFDdAmRVJh', 'DsmdOvsiU7', 'xW9dxCCdBM'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, PenYE0tkOYCLDqwRMy.cs High entropy of concatenated method names: 'OZ2WqovcLY', 'W6EWpoJ0FP', 'YDNWLn2lWn', 'S5DWkwfnRL', 'HxhW098Ls7', 'cd8W4UiHtJ', 'lEnWGZAEua', 'nWyWjpUK0y', 'Lk5WBYBomk', 'faJWv5feyx'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, DWbfV733wDM7SoPHEF6.cs High entropy of concatenated method names: 'ToString', 'yf59dP2XpZ', 'bUX9H0j1dF', 'v4l9l26UMr', 'qWM9ghK2xI', 'asS9WUxQg4', 'ioo9Frw13P', 'GJF9n3jBEw', 'Ptm8aGGrnB507pBDKR0', 'cCPRQuGGl0M7NqkkF6P'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, qKcUIQWYkr2kHlVcDF.cs High entropy of concatenated method names: 'Dispose', 'FMN3B1onPs', 'aBvKN0TurG', 'RonttfPa2y', 'xXO3vvN8bY', 'U5q3zG3h2W', 'ProcessDialogKey', 'BdbKYqQ9hF', 'Sg8K35nfpH', 'SYgKKgspkO'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, v0UVJv4Fuk8ZSL2f7F.cs High entropy of concatenated method names: 'ADTCjxTKwn', 'AxCCvrCUPZ', 'gbiyY7k1ll', 'P8Sy3rvXf6', 'WIqCJCqSkS', 'xg4CIc3Ebq', 'K4JCwhA34c', 'zIOCq3LxMo', 'SybCpGX2uA', 'yQgCLHIsRV'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, ALpl925dRu9MqQXKDu.cs High entropy of concatenated method names: 'oIwiLLvTPx', 'DPPik0p32Z', 'UBji0ZAewF', 'ToString', 'UVPi4hnMHU', 'cuMiGGoli3', 'TYugPnwIkXNdX6d0qcq', 'iMScspwfwXoIf5qeD4r', 'uRnOqOwmsq7sFZfWfJA', 'jIq298wgC0fl9F1MINd'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, fJAQuF3YIVEeN8MhNPj.cs High entropy of concatenated method names: 'mVQmVGrnR1', 'SAcmRDBpb4', 'VJHmehkTYa', 'wALmZg41J8', 'l03m8bMRp3', 'TfymTpkQnB', 'eQ5mbW1sDA', 'bAfmtTOLXs', 'JNxm1sSiNM', 'yZRmECQ6Eo'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, icvX8XzjLawXkxgs9u.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jjMmMwHhTW', 'Aqvm7r0f0G', 'gVsmS14DUf', 'ENtmCIbPXV', 'mV7myWetvB', 'HiXmmtg9SP', 'khGm9XRUjO'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, EyMqHCPs9E9FenpsLm.cs High entropy of concatenated method names: 'xvBagsCXW4', 'J7raFH66Eq', 'kP5aiVR3wa', 'QV9ivkLh0v', 'nTSiz5yecs', 'fNAaYUDGxS', 'IMma3TLuYM', 'SYCaKj6rdg', 'YufadClNQk', 'bh8aHJeSs7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, sXXw773dDD510lc6jEC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PGK9qQkYUJ', 'wEg9pijEGS', 'heX9LhSSuN', 'mjg9kJ5mtE', 'pUP90e6fmX', 'wJ794VXkGu', 'ySc9G2eFjM'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, DqQ9hFBLg85nfpHLYg.cs High entropy of concatenated method names: 'UEKyuBooGO', 'zHfyNtb4tI', 'pKvyQ9sLPA', 'dmiyhubaq7', 'X7qyqZp5UG', 'yoXy6FA4ph', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, xOjHSwE9BsL66jh6xb.cs High entropy of concatenated method names: 'WhBn8QlguT', 'I6nnbLN2Vn', 'd74FQsRJUf', 'm6rFhsgGx8', 'qCmF67MAsI', 'bGYF5sTXdw', 'upQFP9ndev', 'fOMFrQi4jm', 'gSOF2TIhRs', 'EALFs1EVqK'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, spQoUaHnJ5qLMKORun.cs High entropy of concatenated method names: 'mcI3aenYE0', 'TOY3ACLDqw', 'xLD3xHjoCr', 'zbX3o9VOjH', 'Wh637xbotv', 'wm33SIEAO1', 'J7x1FueM0GLDd6eQnJ', 'KWGbqQbychIN9Ffyr3', 'wJw33b2NCf', 'z4m3d0066t'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, SiNRcVkQKnvrVZtVoQ.cs High entropy of concatenated method names: 'wM1CxvY9Hs', 'oDwCoQd8vo', 'ToString', 'pjrCgXAEu3', 'OW5CWIiYmK', 'gAOCFcjJSm', 'VjWCnh6dhi', 'TK4CieaxFB', 'kbMCaJUjQy', 'LHgCAXEZCU'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, xo5PZY2ot5o5nvQbi0.cs High entropy of concatenated method names: 'eaXaVV6l9r', 'AZmaRmIx87', 'VVwaeXiXiX', 'eudaZIRScA', 'H8va8iWjmv', 'FsyaTgpsXj', 'S5uab8LvLP', 'clSatNDI7e', 'gnka17QghX', 'gNXaEDiCyV'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, RdIWAaqWmQBYJZJocJ.cs High entropy of concatenated method names: 'v0j7svN4HF', 'dSZ7IY9GTv', 'DYn7qGJLat', 'nBa7phdhlR', 'kwv7NeB87C', 'egY7QhGgvq', 'JwT7h6SR7W', 'BGn76kVla3', 'rba75e67Dn', 'mVO7PCbnyJ'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, fspkOWvogMOU36TAoN.cs High entropy of concatenated method names: 'tAFm3abwfM', 'MdQmd7WPix', 'zKXmHgWhfm', 'BtgmgIq9iP', 'HBwmWhy1lP', 'nLUmnbxyYJ', 'LMimiFeyPP', 'dK1yGqRw0L', 'gr8yjHqQF7', 'KAuyB7pl29'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, s1uhC0LTpfAvYaiZjt.cs High entropy of concatenated method names: 'ToString', 'TaSSJOUJdB', 'dToSNfMl8Q', 'hy7SQ70x57', 'jWAShpYpHZ', 'RwDS6eNviQ', 'Ts3S5WRtih', 'QIDSPoU7gc', 'TN6SrEtM3L', 'o9KS2mg7Nm'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, SgBrdEKGapRfKEKkNh.cs High entropy of concatenated method names: 'b5WeuaXnF', 'YjHZGiX7Y', 'R7BTVxfZk', 'FGHbPNuMS', 'KZY1JCQnM', 'XSrEqPofF', 'vKfgkcD8PCy0jh8eIi', 'NfIKNlCuym4prw6cmX', 'XMmyUUe55', 'OmA9Y4kE7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.441f430.2.raw.unpack, OpOgmCw6PPUf8olH7e.cs High entropy of concatenated method names: 'lCSMt1g6rh', 'uxyM11trDN', 'MRpMukmKFN', 'Y28MNRm8OM', 'oK3MhnWw5x', 'd6iM60vqO1', 'ApuMPNwdt1', 'bBZMr7DNuO', 'EHGMsZAr8Q', 'DYtMJObaU1'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, oxcyjc1LDHjoCrebX9.cs High entropy of concatenated method names: 'CpeFZUsOAK', 'ffWFT0XXQ8', 'cRvFt9btKt', 'zT9F1vSx30', 'TpJF76fsMy', 'h1bFSO0WEQ', 'vVUFCJYFHA', 'bhhFytBCp0', 'u0kFmVGkif', 'C9MF9meTA7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, mtvXm3uIEAO1aOMiyD.cs High entropy of concatenated method names: 'c0milBFjFK', 'hTOiWMHxTV', 'AsPinGlJIO', 'g1uiar8qjC', 'NZxiAZVchj', 'GD0n0QGOqE', 'qIhn4jjovH', 'N9DnGh5vjd', 'HudnjUsN51', 'qHwnBQoRpn'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, wOvN8bjY05qG3h2W8d.cs High entropy of concatenated method names: 'Sr6ygxiaYx', 'rwfyWo1LHn', 'J3yyFIWqgs', 'prAynrpD0X', 'KMDyiBaq2C', 'skMyasn07F', 'oLiyAycMAm', 'qu2yOwgwf7', 'd5fyxlQnuc', 'KIvyoQ4EBQ'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, YL2q2YAVtmpvhXuwY3.cs High entropy of concatenated method names: 'nGjdlidUc5', 'BEOdgtBWR3', 'f3EdWwfCY8', 'k00dF4aMpe', 'XCAdnpjDT0', 'mLgdih6Yrv', 'qZrdaV1W46', 'TFDdAmRVJh', 'DsmdOvsiU7', 'xW9dxCCdBM'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, PenYE0tkOYCLDqwRMy.cs High entropy of concatenated method names: 'OZ2WqovcLY', 'W6EWpoJ0FP', 'YDNWLn2lWn', 'S5DWkwfnRL', 'HxhW098Ls7', 'cd8W4UiHtJ', 'lEnWGZAEua', 'nWyWjpUK0y', 'Lk5WBYBomk', 'faJWv5feyx'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, DWbfV733wDM7SoPHEF6.cs High entropy of concatenated method names: 'ToString', 'yf59dP2XpZ', 'bUX9H0j1dF', 'v4l9l26UMr', 'qWM9ghK2xI', 'asS9WUxQg4', 'ioo9Frw13P', 'GJF9n3jBEw', 'Ptm8aGGrnB507pBDKR0', 'cCPRQuGGl0M7NqkkF6P'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, qKcUIQWYkr2kHlVcDF.cs High entropy of concatenated method names: 'Dispose', 'FMN3B1onPs', 'aBvKN0TurG', 'RonttfPa2y', 'xXO3vvN8bY', 'U5q3zG3h2W', 'ProcessDialogKey', 'BdbKYqQ9hF', 'Sg8K35nfpH', 'SYgKKgspkO'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, v0UVJv4Fuk8ZSL2f7F.cs High entropy of concatenated method names: 'ADTCjxTKwn', 'AxCCvrCUPZ', 'gbiyY7k1ll', 'P8Sy3rvXf6', 'WIqCJCqSkS', 'xg4CIc3Ebq', 'K4JCwhA34c', 'zIOCq3LxMo', 'SybCpGX2uA', 'yQgCLHIsRV'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, ALpl925dRu9MqQXKDu.cs High entropy of concatenated method names: 'oIwiLLvTPx', 'DPPik0p32Z', 'UBji0ZAewF', 'ToString', 'UVPi4hnMHU', 'cuMiGGoli3', 'TYugPnwIkXNdX6d0qcq', 'iMScspwfwXoIf5qeD4r', 'uRnOqOwmsq7sFZfWfJA', 'jIq298wgC0fl9F1MINd'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, fJAQuF3YIVEeN8MhNPj.cs High entropy of concatenated method names: 'mVQmVGrnR1', 'SAcmRDBpb4', 'VJHmehkTYa', 'wALmZg41J8', 'l03m8bMRp3', 'TfymTpkQnB', 'eQ5mbW1sDA', 'bAfmtTOLXs', 'JNxm1sSiNM', 'yZRmECQ6Eo'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, icvX8XzjLawXkxgs9u.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jjMmMwHhTW', 'Aqvm7r0f0G', 'gVsmS14DUf', 'ENtmCIbPXV', 'mV7myWetvB', 'HiXmmtg9SP', 'khGm9XRUjO'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, EyMqHCPs9E9FenpsLm.cs High entropy of concatenated method names: 'xvBagsCXW4', 'J7raFH66Eq', 'kP5aiVR3wa', 'QV9ivkLh0v', 'nTSiz5yecs', 'fNAaYUDGxS', 'IMma3TLuYM', 'SYCaKj6rdg', 'YufadClNQk', 'bh8aHJeSs7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, sXXw773dDD510lc6jEC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PGK9qQkYUJ', 'wEg9pijEGS', 'heX9LhSSuN', 'mjg9kJ5mtE', 'pUP90e6fmX', 'wJ794VXkGu', 'ySc9G2eFjM'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, DqQ9hFBLg85nfpHLYg.cs High entropy of concatenated method names: 'UEKyuBooGO', 'zHfyNtb4tI', 'pKvyQ9sLPA', 'dmiyhubaq7', 'X7qyqZp5UG', 'yoXy6FA4ph', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, xOjHSwE9BsL66jh6xb.cs High entropy of concatenated method names: 'WhBn8QlguT', 'I6nnbLN2Vn', 'd74FQsRJUf', 'm6rFhsgGx8', 'qCmF67MAsI', 'bGYF5sTXdw', 'upQFP9ndev', 'fOMFrQi4jm', 'gSOF2TIhRs', 'EALFs1EVqK'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, spQoUaHnJ5qLMKORun.cs High entropy of concatenated method names: 'mcI3aenYE0', 'TOY3ACLDqw', 'xLD3xHjoCr', 'zbX3o9VOjH', 'Wh637xbotv', 'wm33SIEAO1', 'J7x1FueM0GLDd6eQnJ', 'KWGbqQbychIN9Ffyr3', 'wJw33b2NCf', 'z4m3d0066t'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, SiNRcVkQKnvrVZtVoQ.cs High entropy of concatenated method names: 'wM1CxvY9Hs', 'oDwCoQd8vo', 'ToString', 'pjrCgXAEu3', 'OW5CWIiYmK', 'gAOCFcjJSm', 'VjWCnh6dhi', 'TK4CieaxFB', 'kbMCaJUjQy', 'LHgCAXEZCU'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, xo5PZY2ot5o5nvQbi0.cs High entropy of concatenated method names: 'eaXaVV6l9r', 'AZmaRmIx87', 'VVwaeXiXiX', 'eudaZIRScA', 'H8va8iWjmv', 'FsyaTgpsXj', 'S5uab8LvLP', 'clSatNDI7e', 'gnka17QghX', 'gNXaEDiCyV'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, RdIWAaqWmQBYJZJocJ.cs High entropy of concatenated method names: 'v0j7svN4HF', 'dSZ7IY9GTv', 'DYn7qGJLat', 'nBa7phdhlR', 'kwv7NeB87C', 'egY7QhGgvq', 'JwT7h6SR7W', 'BGn76kVla3', 'rba75e67Dn', 'mVO7PCbnyJ'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, fspkOWvogMOU36TAoN.cs High entropy of concatenated method names: 'tAFm3abwfM', 'MdQmd7WPix', 'zKXmHgWhfm', 'BtgmgIq9iP', 'HBwmWhy1lP', 'nLUmnbxyYJ', 'LMimiFeyPP', 'dK1yGqRw0L', 'gr8yjHqQF7', 'KAuyB7pl29'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, s1uhC0LTpfAvYaiZjt.cs High entropy of concatenated method names: 'ToString', 'TaSSJOUJdB', 'dToSNfMl8Q', 'hy7SQ70x57', 'jWAShpYpHZ', 'RwDS6eNviQ', 'Ts3S5WRtih', 'QIDSPoU7gc', 'TN6SrEtM3L', 'o9KS2mg7Nm'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, SgBrdEKGapRfKEKkNh.cs High entropy of concatenated method names: 'b5WeuaXnF', 'YjHZGiX7Y', 'R7BTVxfZk', 'FGHbPNuMS', 'KZY1JCQnM', 'XSrEqPofF', 'vKfgkcD8PCy0jh8eIi', 'NfIKNlCuym4prw6cmX', 'XMmyUUe55', 'OmA9Y4kE7'
Source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.44d9c50.1.raw.unpack, OpOgmCw6PPUf8olH7e.cs High entropy of concatenated method names: 'lCSMt1g6rh', 'uxyM11trDN', 'MRpMukmKFN', 'Y28MNRm8OM', 'oK3MhnWw5x', 'd6iM60vqO1', 'ApuMPNwdt1', 'bBZMr7DNuO', 'EHGMsZAr8Q', 'DYtMJObaU1'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, oxcyjc1LDHjoCrebX9.cs High entropy of concatenated method names: 'CpeFZUsOAK', 'ffWFT0XXQ8', 'cRvFt9btKt', 'zT9F1vSx30', 'TpJF76fsMy', 'h1bFSO0WEQ', 'vVUFCJYFHA', 'bhhFytBCp0', 'u0kFmVGkif', 'C9MF9meTA7'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, mtvXm3uIEAO1aOMiyD.cs High entropy of concatenated method names: 'c0milBFjFK', 'hTOiWMHxTV', 'AsPinGlJIO', 'g1uiar8qjC', 'NZxiAZVchj', 'GD0n0QGOqE', 'qIhn4jjovH', 'N9DnGh5vjd', 'HudnjUsN51', 'qHwnBQoRpn'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, wOvN8bjY05qG3h2W8d.cs High entropy of concatenated method names: 'Sr6ygxiaYx', 'rwfyWo1LHn', 'J3yyFIWqgs', 'prAynrpD0X', 'KMDyiBaq2C', 'skMyasn07F', 'oLiyAycMAm', 'qu2yOwgwf7', 'd5fyxlQnuc', 'KIvyoQ4EBQ'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, YL2q2YAVtmpvhXuwY3.cs High entropy of concatenated method names: 'nGjdlidUc5', 'BEOdgtBWR3', 'f3EdWwfCY8', 'k00dF4aMpe', 'XCAdnpjDT0', 'mLgdih6Yrv', 'qZrdaV1W46', 'TFDdAmRVJh', 'DsmdOvsiU7', 'xW9dxCCdBM'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, PenYE0tkOYCLDqwRMy.cs High entropy of concatenated method names: 'OZ2WqovcLY', 'W6EWpoJ0FP', 'YDNWLn2lWn', 'S5DWkwfnRL', 'HxhW098Ls7', 'cd8W4UiHtJ', 'lEnWGZAEua', 'nWyWjpUK0y', 'Lk5WBYBomk', 'faJWv5feyx'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, DWbfV733wDM7SoPHEF6.cs High entropy of concatenated method names: 'ToString', 'yf59dP2XpZ', 'bUX9H0j1dF', 'v4l9l26UMr', 'qWM9ghK2xI', 'asS9WUxQg4', 'ioo9Frw13P', 'GJF9n3jBEw', 'Ptm8aGGrnB507pBDKR0', 'cCPRQuGGl0M7NqkkF6P'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, qKcUIQWYkr2kHlVcDF.cs High entropy of concatenated method names: 'Dispose', 'FMN3B1onPs', 'aBvKN0TurG', 'RonttfPa2y', 'xXO3vvN8bY', 'U5q3zG3h2W', 'ProcessDialogKey', 'BdbKYqQ9hF', 'Sg8K35nfpH', 'SYgKKgspkO'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, v0UVJv4Fuk8ZSL2f7F.cs High entropy of concatenated method names: 'ADTCjxTKwn', 'AxCCvrCUPZ', 'gbiyY7k1ll', 'P8Sy3rvXf6', 'WIqCJCqSkS', 'xg4CIc3Ebq', 'K4JCwhA34c', 'zIOCq3LxMo', 'SybCpGX2uA', 'yQgCLHIsRV'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, ALpl925dRu9MqQXKDu.cs High entropy of concatenated method names: 'oIwiLLvTPx', 'DPPik0p32Z', 'UBji0ZAewF', 'ToString', 'UVPi4hnMHU', 'cuMiGGoli3', 'TYugPnwIkXNdX6d0qcq', 'iMScspwfwXoIf5qeD4r', 'uRnOqOwmsq7sFZfWfJA', 'jIq298wgC0fl9F1MINd'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, fJAQuF3YIVEeN8MhNPj.cs High entropy of concatenated method names: 'mVQmVGrnR1', 'SAcmRDBpb4', 'VJHmehkTYa', 'wALmZg41J8', 'l03m8bMRp3', 'TfymTpkQnB', 'eQ5mbW1sDA', 'bAfmtTOLXs', 'JNxm1sSiNM', 'yZRmECQ6Eo'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, icvX8XzjLawXkxgs9u.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jjMmMwHhTW', 'Aqvm7r0f0G', 'gVsmS14DUf', 'ENtmCIbPXV', 'mV7myWetvB', 'HiXmmtg9SP', 'khGm9XRUjO'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, EyMqHCPs9E9FenpsLm.cs High entropy of concatenated method names: 'xvBagsCXW4', 'J7raFH66Eq', 'kP5aiVR3wa', 'QV9ivkLh0v', 'nTSiz5yecs', 'fNAaYUDGxS', 'IMma3TLuYM', 'SYCaKj6rdg', 'YufadClNQk', 'bh8aHJeSs7'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, sXXw773dDD510lc6jEC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PGK9qQkYUJ', 'wEg9pijEGS', 'heX9LhSSuN', 'mjg9kJ5mtE', 'pUP90e6fmX', 'wJ794VXkGu', 'ySc9G2eFjM'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, DqQ9hFBLg85nfpHLYg.cs High entropy of concatenated method names: 'UEKyuBooGO', 'zHfyNtb4tI', 'pKvyQ9sLPA', 'dmiyhubaq7', 'X7qyqZp5UG', 'yoXy6FA4ph', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, xOjHSwE9BsL66jh6xb.cs High entropy of concatenated method names: 'WhBn8QlguT', 'I6nnbLN2Vn', 'd74FQsRJUf', 'm6rFhsgGx8', 'qCmF67MAsI', 'bGYF5sTXdw', 'upQFP9ndev', 'fOMFrQi4jm', 'gSOF2TIhRs', 'EALFs1EVqK'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, spQoUaHnJ5qLMKORun.cs High entropy of concatenated method names: 'mcI3aenYE0', 'TOY3ACLDqw', 'xLD3xHjoCr', 'zbX3o9VOjH', 'Wh637xbotv', 'wm33SIEAO1', 'J7x1FueM0GLDd6eQnJ', 'KWGbqQbychIN9Ffyr3', 'wJw33b2NCf', 'z4m3d0066t'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, SiNRcVkQKnvrVZtVoQ.cs High entropy of concatenated method names: 'wM1CxvY9Hs', 'oDwCoQd8vo', 'ToString', 'pjrCgXAEu3', 'OW5CWIiYmK', 'gAOCFcjJSm', 'VjWCnh6dhi', 'TK4CieaxFB', 'kbMCaJUjQy', 'LHgCAXEZCU'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, xo5PZY2ot5o5nvQbi0.cs High entropy of concatenated method names: 'eaXaVV6l9r', 'AZmaRmIx87', 'VVwaeXiXiX', 'eudaZIRScA', 'H8va8iWjmv', 'FsyaTgpsXj', 'S5uab8LvLP', 'clSatNDI7e', 'gnka17QghX', 'gNXaEDiCyV'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, RdIWAaqWmQBYJZJocJ.cs High entropy of concatenated method names: 'v0j7svN4HF', 'dSZ7IY9GTv', 'DYn7qGJLat', 'nBa7phdhlR', 'kwv7NeB87C', 'egY7QhGgvq', 'JwT7h6SR7W', 'BGn76kVla3', 'rba75e67Dn', 'mVO7PCbnyJ'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, fspkOWvogMOU36TAoN.cs High entropy of concatenated method names: 'tAFm3abwfM', 'MdQmd7WPix', 'zKXmHgWhfm', 'BtgmgIq9iP', 'HBwmWhy1lP', 'nLUmnbxyYJ', 'LMimiFeyPP', 'dK1yGqRw0L', 'gr8yjHqQF7', 'KAuyB7pl29'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, s1uhC0LTpfAvYaiZjt.cs High entropy of concatenated method names: 'ToString', 'TaSSJOUJdB', 'dToSNfMl8Q', 'hy7SQ70x57', 'jWAShpYpHZ', 'RwDS6eNviQ', 'Ts3S5WRtih', 'QIDSPoU7gc', 'TN6SrEtM3L', 'o9KS2mg7Nm'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, SgBrdEKGapRfKEKkNh.cs High entropy of concatenated method names: 'b5WeuaXnF', 'YjHZGiX7Y', 'R7BTVxfZk', 'FGHbPNuMS', 'KZY1JCQnM', 'XSrEqPofF', 'vKfgkcD8PCy0jh8eIi', 'NfIKNlCuym4prw6cmX', 'XMmyUUe55', 'OmA9Y4kE7'
Source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, OpOgmCw6PPUf8olH7e.cs High entropy of concatenated method names: 'lCSMt1g6rh', 'uxyM11trDN', 'MRpMukmKFN', 'Y28MNRm8OM', 'oK3MhnWw5x', 'd6iM60vqO1', 'ApuMPNwdt1', 'bBZMr7DNuO', 'EHGMsZAr8Q', 'DYtMJObaU1'
Contains functionality to download and launch executables
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00406EB0 ShellExecuteW,URLDownloadToFileW, 15_2_00406EB0
Drops PE files
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe File created: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpBE91.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 15_2_0041AA4A

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: docx.pif Static PE information: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 15_2_0041CB50
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR
Delayed program exit found
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040F7A7 Sleep,ExitProcess, 15_2_0040F7A7
Opens the same file many times (likely Sandbox evasion)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: \Device\RasAcd count: 189384 Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 2700000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 2740000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 4740000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 77E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 6C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 87E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 97E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: 9B50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: AB50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: BB50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: CDA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: DDA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: EDA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: F470000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 12A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 2A60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 4A60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 72D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 82D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 8460000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 9460000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 9780000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: A780000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 72D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 8460000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: 9780000 memory reserve | memory write watch Jump to behavior
Contains functionality to enumerate running services
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 15_2_0041A748
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6847 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 613 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7295 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: threadDelayed 390 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: threadDelayed 4819 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: foregroundWindowGot 1728 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe API coverage: 6.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe TID: 1856 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 828 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4284 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5348 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5580 Thread sleep count: 114 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5580 Thread sleep time: -57000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4616 Thread sleep count: 390 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4616 Thread sleep time: -1170000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4748 Thread sleep count: 121 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4748 Thread sleep time: -121000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4616 Thread sleep count: 4819 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4616 Thread sleep time: -14457000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4748 Thread sleep count: 295 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4748 Thread sleep time: -295000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe TID: 4196 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 15_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 15_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 15_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 15_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0044E879 FindFirstFileExA, 15_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 15_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040783C FindFirstFileW,FindNextFileW, 15_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, 15_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 15_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 15_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 15_2_00407C97
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: TkdxROLUOVpK.exe, 0000000A.00000002.2137224054.0000000006D95000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11de
Source: vbc.exe, 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_004349F9
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 15_2_0041CB50
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004432B5 mov eax, dword ptr fs:[00000030h] 15_2_004432B5
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00412077 GetProcessHeap,HeapFree, 15_2_00412077
Enables debug privileges
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00434B47 SetUnhandledExceptionFilter, 15_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 15_2_00434FDC
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe"
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe"
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe" Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 459000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 471000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 477000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 478000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 479000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 47E000 Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4D7A008 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 459000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 471000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 477000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 478000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 479000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 47E000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 51E1008 Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe 15_2_004120F7
Contains functionality to simulate mouse events
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00419627 mouse_event, 15_2_00419627
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpBE91.tmp" Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpCDF3.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: vbc.exe, 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerknown.
Source: vbc.exe, 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerspirpc
Source: vbc.exe, 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp, logs.dat.9.dr Binary or memory string: [Program Manager]
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00434C52 cpuid 15_2_00434C52
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: EnumSystemLocalesW, 15_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 15_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetLocaleInfoW, 15_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: EnumSystemLocalesW, 15_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 15_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetLocaleInfoW, 15_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 15_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetLocaleInfoA, 15_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: GetLocaleInfoW, 15_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 15_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: EnumSystemLocalesW, 15_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: EnumSystemLocalesW, 15_2_00451F9B
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Queries volume information: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Queries volume information: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0040B164 GetLocalTime,wsprintfW, 15_2_0040B164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_0041B60D GetUserNameW, 15_2_0041B60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 15_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 15_2_00449190
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2107662526.00000000054E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\gaban\logs.dat, type: DROPPED
Contains functionality to steal Chrome passwords or cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 15_2_0040BA12
Contains functionality to steal Firefox passwords or cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\ 15_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: \key3.db 15_2_0040BB30

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-5MRRQ3 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-5MRRQ3 Jump to behavior
Yara detected Remcos RAT
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.381f058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.37a6638.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3c623e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3be99c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.TkdxROLUOVpK.exe.3b2f1a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.4510842027.000000000504B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2107662526.00000000054E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2106236998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2092193357.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2131352258.0000000003AC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: #U8f6e#U6905-#U89c4#U683c.docx.pif.exe PID: 3628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TkdxROLUOVpK.exe PID: 2892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 5456, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\gaban\logs.dat, type: DROPPED
Contains functionality to launch a control a shell (cmd.exe)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: cmd.exe 15_2_0040569A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1466661 Sample: #U8f6e#U6905-#U89c4#U683c.d... Startdate: 03/07/2024 Architecture: WINDOWS Score: 100 50 www.vipguyclassproject2024.space 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus detection for URL or domain 2->56 58 13 other signatures 2->58 8 #U8f6e#U6905-#U89c4#U683c.docx.pif.exe 7 2->8         started        12 TkdxROLUOVpK.exe 5 2->12         started        signatures3 process4 file5 40 C:\Users\user\AppData\...\TkdxROLUOVpK.exe, PE32 8->40 dropped 42 C:\Users\...\TkdxROLUOVpK.exe:Zone.Identifier, ASCII 8->42 dropped 44 C:\Users\user\AppData\Local\...\tmpBE91.tmp, XML 8->44 dropped 46 #U8f6e#U6905-#U89c...3c.docx.pif.exe.log, ASCII 8->46 dropped 60 Uses schtasks.exe or at.exe to add and modify task schedules 8->60 62 Writes to foreign memory regions 8->62 64 Allocates memory in foreign processes 8->64 66 Adds a directory exclusion to Windows Defender 8->66 14 vbc.exe 3 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        68 Multi AV Scanner detection for dropped file 12->68 70 Machine Learning detection for dropped file 12->70 72 Injects a PE file into a foreign processes 12->72 24 vbc.exe 12->24         started        26 schtasks.exe 1 12->26         started        28 vbc.exe 12->28         started        signatures6 process7 file8 48 C:\ProgramData\gaban\logs.dat, data 14->48 dropped 74 Contains functionality to bypass UAC (CMSTPLUA) 14->74 76 Detected Remcos RAT 14->76 78 Contains functionalty to change the wallpaper 14->78 82 6 other signatures 14->82 80 Loading BitLocker PowerShell Module 18->80 30 WmiPrvSE.exe 18->30         started        32 conhost.exe 18->32         started        34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 26->38         started        signatures9 process10
⊘No contacted IP infos

Contacted Domains

Name IP Active
www.vipguyclassproject2024.space unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.vipguyclassproject2024.space true
  • Avira URL Cloud: malware
 unknown