Windows Analysis Report
WolferVPN.exe

Overview

General Information

Sample Name: WolferVPN.exe
Analysis ID: 1352257
MD5: 6434ceafa88a3afa1f8351bc6890b2a5
SHA1: 700b43db6881bc83c6d7acb0d020283dca4fa7ba
SHA256: db230e271893be37515e7bf1403352d99a5f8ac441c2df589551ee399dea7315
Tags: BbyStealerexe
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Drops PE files to the startup folder
Drops large PE files
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Drops files with a non-matching file extension (content does not match file extension)
Queries the volume information (name, serial number etc) of a device
Drops PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
PE file contains sections with non-standard names
Creates a start menu entry (Start Menu\Programs\Startup)
Queries keyboard layouts
Enables security privileges
Stores files to the Windows start menu directory
PE file contains more sections than normal
Found dropped PE file which has not been started or loaded
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Searches for user specific document files

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Multi AV Scanner detection for domain / URL
Source: rufflesrefined.com Virustotal: Detection: 16% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\b1c3f10e-540e-46f8-9bee-83879b20c9f6.tmp.node ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Temp\b1c3f10e-540e-46f8-9bee-83879b20c9f6.tmp.node Virustotal: Detection: 40% Perma Link
Uses 32bit PE files
Source: WolferVPN.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\9c1054f2-f2ad-5af7-8c3f-0bca1902f573 Jump to behavior
Source: WolferVPN.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Programs\WolferVPN Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Programs\WolferVPN\resources Jump to behavior
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.64.41.3 172.64.41.3
Source: unknown Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52645 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51561 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54609 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57047 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51573 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52517
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52515
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown Network traffic detected: HTTP traffic on port 56803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52519
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52512
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52513
Source: unknown Network traffic detected: HTTP traffic on port 53537 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52511
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown Network traffic detected: HTTP traffic on port 57023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52527
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52529
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52520
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown Network traffic detected: HTTP traffic on port 52453 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51957 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52523
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52521
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52539
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown Network traffic detected: HTTP traffic on port 57011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52537
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52531
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52535
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown Network traffic detected: HTTP traffic on port 54851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52533
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53525 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52549
Source: unknown Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52547
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52541
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52540
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52545
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52543
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown Network traffic detected: HTTP traffic on port 56827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown Network traffic detected: HTTP traffic on port 57288 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52441 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown Network traffic detected: HTTP traffic on port 52477 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55299 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown Network traffic detected: HTTP traffic on port 51139 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53501 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52465 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52503
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52509
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52508
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52501
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown Network traffic detected: HTTP traffic on port 53513 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52475
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52473
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52479
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown Network traffic detected: HTTP traffic on port 57215 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52477
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52478
Source: unknown Network traffic detected: HTTP traffic on port 54201 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56623 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52483
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52481
Source: unknown Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53357 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57203 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53345 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52487
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown Network traffic detected: HTTP traffic on port 57685 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52485
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52488
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52489
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown Network traffic detected: HTTP traffic on port 57456 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57227 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56635 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55046 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52497
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown Network traffic detected: HTTP traffic on port 53369 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52499
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown Network traffic detected: HTTP traffic on port 54191 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown Network traffic detected: HTTP traffic on port 57673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown Network traffic detected: HTTP traffic on port 54225 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown Network traffic detected: HTTP traffic on port 53333 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52439
Source: unknown Network traffic detected: HTTP traffic on port 56576 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52437
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown Network traffic detected: HTTP traffic on port 55984 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52431
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52435
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52433
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown Network traffic detected: HTTP traffic on port 56839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown Network traffic detected: HTTP traffic on port 55058 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57503 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown Network traffic detected: HTTP traffic on port 56659 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52448
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52449
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52441
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52446
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52447
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51113
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52445
Source: unknown Network traffic detected: HTTP traffic on port 53550 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53775
Source: unknown Network traffic detected: HTTP traffic on port 56564 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56588 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53781
Source: unknown Network traffic detected: HTTP traffic on port 55996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52450
Source: unknown Network traffic detected: HTTP traffic on port 54142 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57240 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54213 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52459
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52453
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52454
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51120
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52451
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52452
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown Network traffic detected: HTTP traffic on port 57493 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52457
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52455
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51125
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52456
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown Network traffic detected: HTTP traffic on port 56840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52460
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52461
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53791
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me/)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://digitalbazaar.com/
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dominictarr.com)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://evanjones.ca/)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://feross.org
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/walling/unorm.git
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/arraybuffer-to-string-apply-performance/2
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/converting-a-uint8array-to-a-string/2
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://n8.io/)
Source: WolferVPN.exe, 00000000.00000000.2162028231.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://pajhome.org.uk/crypt/md5
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://seclists.org/fulldisclosure/2009/Sep/394
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stuartk.com/jszip
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stuk.github.io/jszip/documentation/howto/read_zip.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://substack.net
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://unicode.org/reports/tr15/
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://unix.stackexchange.com/questions/14705/the-zip-formats-external-file-attribute
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://webrsa.cvs.sourceforge.net/viewvc/webrsa/Client/RSAES-OAEP.js?content-type=text%2Fplain:
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wiki.ecmascript.org/doku.php?id=harmony:specification_drafts#november_8_2013_draft_rev_21
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wiki.ecmascript.org/doku.php?id=strawman:concurrency&rev=1308776521#allfulfilled
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/52/13.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/65/16.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/66/16.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-262.pdf
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.exodus.io)
Source: WolferVPN.exe, 00000000.00000003.2261017258.0000000006460000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fossil-scm.org/
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.futurealoof.com)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0-standalone.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ietf.org/rfc/rfc2315.txt):
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.info-zip.org/FAQ.html#backslashes
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.joyent.com
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.netdealing.com
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.openssl.org/docs/crypto/EVP_BytesToKey.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.rsa.com/rsalabs/node.asp?id=2125
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.tero.co.uk/des/
Source: WolferVPN.exe, 00000000.00000003.2261017258.0000000006460000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org
Source: WolferVPN.exe, 00000000.00000003.2248611287.0000000005650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/copyright.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.webtoolkit.info/
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://zlib.net/manual.html#Advanced
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://zlib.net/manual.html#Advanced)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/opensource/security/bounty)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/opensource/security/cvd).
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/opensource/security/definition)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/opensource/security/msrc).
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/opensource/security/pgpkey).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7468#section-7
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Operators/Bitwise_Operators
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://feross.org
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://feross.org/opensource
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://feross.org/support
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Azure)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Microsoft)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Microsoft/tslib.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Mostafa-Samir/zip-local.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Mostafa-Samir/zip-local/blob/master/LICENSE
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/PeculiarVentures/webcrypto-core#readme
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/PeculiarVentures/webcrypto-core.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/RyanZim/universalify.git
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/TooTallNate
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/agnat
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/aspnet)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/bnoordhuis
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/brett19
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/crypto-browserify/md5.js
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/crypto-browserify/md5.js.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/crypto-browserify/randombytes
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/crypto-browserify/ripemd160
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/crypto-browserify/sha.js
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/cryptocoinjs/base-x
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dchest/tweetnacl-js
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/defunctzombie/node-util
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/digitalbazaar/forge
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/digitalbazaar/forge/blob/master/lib/asn1.js#L542
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominictarr/rc.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominictarr/varstruct
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominictarr/varstruct.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dotnet)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/node-abi#readme
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/node-abi.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/exodusmovement/seco-file#readme
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/exodusmovement/seco-file.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/exodusmovement/secure-container#readme
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/exodusmovement/secure-container.git
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fanatid)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/feross/safe-buffer
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/feross/simple-concat
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/feross/simple-get
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inspiredware/napi-build-utils#napi-build-utils).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inspiredware/napi-build-utils#readme
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inspiredware/napi-build-utils.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/yallist.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kjur/jsjws/blob/master/rsa.js:
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kkaefer/node-zlib
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kkoopa
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/libuv/libuv/commit/92fb84b751e18f032c02609467f44bfe927b80c5
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/mkdirp-classic
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/mkdirp-classic.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/pump
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/minimistjs/minimist
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mkrufky
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodeca/pako/
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodeca/pako/blob/master/LICENSE
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/nan
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/nan#wg-members--collaborators
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/nan/blob/master/LICENSE.md
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/nan/issues/832.
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/nan/pull/811#discussion_r224594980.
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/blob/master/lib/internal/crypto/random.js#L48
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/string_decoder
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-semver.git
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/wrappy
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/prebuild/prebuild#prebuild)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/rvagg
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/feross
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/ljharb
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/trevnorris
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/v8/v8/wiki/Embedder%27s%20Guide#handles-and-garbage-collection).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/v8/v8/wiki/Embedder%27s-Guide#templates)
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/xamarin)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/yetingli
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://hackage.haskell.org/package/base/docs/Data-Maybe.html.
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/addons.html#addons_wrapping_c_objects)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/http.html#http_class_http_incomingmessage
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/n-api.html#n_api_n_api)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/dist/latest-v9.x/docs/api/async_hooks.html
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/dist/latest-v9.x/docs/api/n-api.html#n_api_custom_asynchronous_operations
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://raw.github.com/Stuk/jszip/master/LICENSE.markdown.
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://semver.org/
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com)
Source: WolferVPN.exe, 00000000.00000003.2260749105.0000000006060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/forum/forumpost/83cb4a95a0
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/lang_savepoint.html
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/wal.html#ckpt
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc8032
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc8410#section-10.3
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/docs/embed#accessors).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/docs/embed#exceptions)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/docs/embed#handles-and-garbage-collection).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8.dev/docs/embed#interceptors).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-0.12/db/d85/classv8_1_1_object.html#acfbdfd7427b516ebdb5c47c4df5e
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-16.0/db/d84/classv8_1_1_script_origin.html#pub-methods)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-4.8/d3/d32/classv8_1_1_array.html#a1d3a878d4c1c7cae974dd50a163924
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d1/d83/classv8_1_1_data.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d2/d78/classv8_1_1_persistent.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d2/db3/classv8_1_1_string.html#a5264d50b96d2c896ce525a734dc1
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d2/db3/classv8_1_1_string.html#a7c1bc8886115d7ee46f1d571dd6e
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d3/d95/classv8_1_1_handle_scope.html).
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d4/d1b/classv8_1_1_string_1_1_utf8_value.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d4/dc6/classv8_1_1_try_catch.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d4/dca/classv8_1_1_persistent_base.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/d40/classv8_1_1_global.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/d54/classv8_1_1_function.html#a9c3d0e4e13ddd7721fce238aa5
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/d54/classv8_1_1_function.html#ae477558b10c14b76ed00e8dbab
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a045d7754e62fa0ec72ae6c259b2
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a24647f61d6b41f69668094bdcd6
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a542d67e85089cb3f92aadf032f9
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a5593ac74687b713095c38987e59
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a580f976e4290cead62c2fc4dd39
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a5f72c7cda21415ce062bbe5c58a
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a6dbef303603ebdb03da6998794e
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a7acadfe7965997e9c386a05f098
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a81c7a1ed7001ae2a65e89107f75
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#aabd223436bc1100a787dadaa024
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#ad6a2a02657f5425ad460060652a
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#ad7f5dc559866343fe6cd8db1f13
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#adca9294555a3908e9f23c7bb0f0
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#ae1a59cac60409d3922582c4af67
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#aeb420b690bc2c216882d6fdd00d
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d7/dc5/classv8_1_1_property_callback_info.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d8/d06/classv8_1_1_weak_callback_info.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d8/d7d/classv8_1_1_maybe_local.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d8/d83/classv8_1_1_function_template.html#a56d904662a86eca78
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d8/d83/classv8_1_1_function_template.html#ab7574b298db3c27fb
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d9/d28/classv8_1_1_message.html#a60ede616ba3822d712e44c7a744
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d9/d28/classv8_1_1_message.html#a849f7a6c41549d83d8159825efc
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d9/d28/classv8_1_1_message.html#aaa004cf19e529da980bc19fcb76
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d9/d28/classv8_1_1_message.html#adbe46c10a88a6565f2732a2d2ad
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d9/d4b/classv8_1_1_maybe.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/d9/db3/classv8_1_1_string_1_1_external_one_byte_string_resou
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/d5c/structv8_1_1_copyable_persistent_traits.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/d6a/classv8_1_1_exception.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/d6f/classv8_1_1_j_s_o_n.html#a44b255c3531489ce43f61102091
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/d6f/classv8_1_1_j_s_o_n.html#a936310d2540fb630ed37d3ee3ff
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/d6f/classv8_1_1_j_s_o_n.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/da5/classv8_1_1_script_compiler.html#a93f5072a0db55d881b9
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/da/da7/classv8_1_1_return_value.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d5f/classv8_1_1_object_template.html#a33b3ebd7de641f6cc64
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d5f/classv8_1_1_object_template.html#a5e9612fc80bf6db8f2d
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d5f/classv8_1_1_object_template.html#ac89f06d634add0e8904
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d5f/classv8_1_1_object_template.html#aca0ed196f8a9adb1f68
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d5f/classv8_1_1_object_template.html#ad605a7543cfbc5dab54
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a138bb32a304f3982be02ad499693
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a169f2da506acbec34deadd9149a1
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a2565f03e736694f6b1e1cf22a0b4
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a442706b22fceda6e6d1f632122a9
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a48e4a19b2cedff867eecc73ddb7d
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a50d571de50d0b0dfb28795619d07
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a580ea84afb26c005d6762eeb9e3c
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a67604ea3734f170c66026064ea80
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a6f76b2ed605cb8f9185b92de0033
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a79a6e4d66049b9aa648ed4dfdb23
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a84471a824576a5994fdd0ffcbf99
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a8700b1862e6b4783716964ba4d5e
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#a9b898894da3d1db2714fd9325a54
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ab3c3d89ea7c2f9afd08965bd7299
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ab3c57184263cf29963ef0017bec8
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ab7a92b4dcf822bef72f6c0ac6fea
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ab7b7245442ca6de1e1c145ea3fd6
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ace1769b0f3b86bfe9fda10109163
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#aced885270cfd2c956367b5eedc7f
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ad3ffc36f3dfc3592ce2a96bc047e
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ad8b80a59c9eb3c1e6c3cd6c84571
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#ae91b3b56b357f285288c89fbddc4
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#af68a0b98066cfdeb8f943e98a40b
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#af743b7ea132b89f84d34d164d066
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/d85/classv8_1_1_object.html#af94fc1135a5e74a2193fb72c3a1b
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/df7/classv8_1_1_template.html#a2db6a56597bf23c59659c0659e
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/db/df7/classv8_1_1_template.html#ae3fbaff137557aa6a0233bc7e5
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/dc/d0a/classv8_1_1_value.html#a08fba1d776a59bbf6864b25f9152c
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/dc/d0a/classv8_1_1_value.html#a2f9770296dc2c8d274bc8cc0dca24
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/dc/d0a/classv8_1_1_value.html#acc5bbef3c805ec458470c0fcd6f13
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/dd/d0d/classv8_1_1_function_callback_info.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/de/d73/classv8_1_1_non_copyable_persistent_traits.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://v8docs.nodesource.com/node-8.16/de/deb/classv8_1_1_local.html)
Source: WolferVPN.exe, 00000000.00000003.2260205445.0000000004A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verificati
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.patreon.com/feross
Source: WolferVPN.exe, 00000000.00000003.2260749105.0000000006060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/src/info/bba7b69f9849b5bf
Source: WolferVPN.exe, 00000000.00000003.2260475006.0000000005250000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.typescriptlang.org/
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: unknown DNS traffic detected: queries for: rufflesrefined.com

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\WolferVPN.exe File dump: WolferVPN.exe.0.dr 163343360 Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File dump: WolferVPN.exe0.0.dr 163343360 Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File dump: Updater.exe.5.dr 163343360 Jump to dropped file
Uses 32bit PE files
Source: WolferVPN.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Enables security privileges
Source: C:\Users\user\Desktop\WolferVPN.exe Process token adjusted: Security Jump to behavior
PE file contains more sections than normal
Source: vulkan-1.dll0.0.dr Static PE information: Number of sections : 11 > 10
Source: Updater.exe.5.dr Static PE information: Number of sections : 15 > 10
Source: libEGL.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll0.0.dr Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.dr Static PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: WolferVPN.exe0.0.dr Static PE information: Number of sections : 15 > 10
Source: WolferVPN.exe.0.dr Static PE information: Number of sections : 15 > 10
Source: libEGL.dll0.0.dr Static PE information: Number of sections : 11 > 10
Source: C:\Users\user\Desktop\WolferVPN.exe File read: C:\Users\user\Desktop\WolferVPN.exe Jump to behavior
Source: WolferVPN.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\WolferVPN.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\WolferVPN.exe C:\Users\user\Desktop\WolferVPN.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe"
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WolferVPN" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1680 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WolferVPN" --mojo-platform-channel-handle=2204 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe"
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WolferVPN" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1680 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WolferVPN" --mojo-platform-channel-handle=2204 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\WolferVPN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1224:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:936:120:WilError_03
Source: C:\Users\user\Desktop\WolferVPN.exe Mutant created: \Sessions\1\BaseNamedObjects\9c1054f2-f2ad-5af7-8c3f-0bca1902f573
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr9663.tmp Jump to behavior
Source: classification engine Classification label: mal68.adwa.spyw.winEXE@17/107@3/2
Source: C:\Users\user\Desktop\WolferVPN.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: WolferVPN.exe Static file information: File size 74280552 > 1048576
Source: C:\Users\user\Desktop\WolferVPN.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\9c1054f2-f2ad-5af7-8c3f-0bca1902f573 Jump to behavior
Source: WolferVPN.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
PE file contains sections with non-standard names
Source: libGLESv2.dll.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr Static PE information: section name: _RDATA
Source: WolferVPN.exe.0.dr Static PE information: section name: .00cfg
Source: WolferVPN.exe.0.dr Static PE information: section name: .gxfg
Source: WolferVPN.exe.0.dr Static PE information: section name: .retplne
Source: WolferVPN.exe.0.dr Static PE information: section name: .rodata
Source: WolferVPN.exe.0.dr Static PE information: section name: CPADinfo
Source: WolferVPN.exe.0.dr Static PE information: section name: LZMADEC
Source: WolferVPN.exe.0.dr Static PE information: section name: _RDATA
Source: WolferVPN.exe.0.dr Static PE information: section name: malloc_h
Source: ffmpeg.dll.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr Static PE information: section name: .retplne
Source: libEGL.dll.0.dr Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr Static PE information: section name: _RDATA
Source: vk_swiftshader.dll0.0.dr Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.dr Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.dr Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr Static PE information: section name: .gxfg
Source: vulkan-1.dll0.0.dr Static PE information: section name: .retplne
Source: vulkan-1.dll0.0.dr Static PE information: section name: _RDATA
Source: WolferVPN.exe0.0.dr Static PE information: section name: .00cfg
Source: WolferVPN.exe0.0.dr Static PE information: section name: .gxfg
Source: WolferVPN.exe0.0.dr Static PE information: section name: .retplne
Source: WolferVPN.exe0.0.dr Static PE information: section name: .rodata
Source: WolferVPN.exe0.0.dr Static PE information: section name: CPADinfo
Source: WolferVPN.exe0.0.dr Static PE information: section name: LZMADEC
Source: WolferVPN.exe0.0.dr Static PE information: section name: _RDATA
Source: WolferVPN.exe0.0.dr Static PE information: section name: malloc_h
Source: ffmpeg.dll0.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr Static PE information: section name: _RDATA
Source: Updater.exe.5.dr Static PE information: section name: .00cfg
Source: Updater.exe.5.dr Static PE information: section name: .gxfg
Source: Updater.exe.5.dr Static PE information: section name: .retplne
Source: Updater.exe.5.dr Static PE information: section name: .rodata
Source: Updater.exe.5.dr Static PE information: section name: CPADinfo
Source: Updater.exe.5.dr Static PE information: section name: LZMADEC
Source: Updater.exe.5.dr Static PE information: section name: _RDATA
Source: Updater.exe.5.dr Static PE information: section name: malloc_h
Source: b1c3f10e-540e-46f8-9bee-83879b20c9f6.tmp.node.5.dr Static PE information: section name: _RDATA
Source: 8aa2ec43-5e03-40f0-b44b-d7dcf4df059c.tmp.node.5.dr Static PE information: section name: _RDATA
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\b1c3f10e-540e-46f8-9bee-83879b20c9f6.tmp.node Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\8aa2ec43-5e03-40f0-b44b-d7dcf4df059c.tmp.node Jump to dropped file
Drops PE files
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\WolferVPN.exe Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\libEGL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\b1c3f10e-540e-46f8-9bee-83879b20c9f6.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\8aa2ec43-5e03-40f0-b44b-d7dcf4df059c.tmp.node Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\LICENSE.electron.txt Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe File created: C:\Users\user\AppData\Local\Programs\WolferVPN\LICENSE.electron.txt Jump to behavior

Boot Survival
barindex
Drops PE files to the startup folder
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\WolferVPN.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr97EA.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\WolferVPN.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\WolferVPN.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Programs\WolferVPN Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Programs\WolferVPN\resources Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "c:\users\user\appdata\local\programs\wolfervpn\wolfervpn.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\wolfervpn" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1680 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "c:\users\user\appdata\local\programs\wolfervpn\wolfervpn.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\wolfervpn" --mojo-platform-channel-handle=2204 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "c:\users\user\appdata\local\programs\wolfervpn\wolfervpn.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\wolfervpn" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1680 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "c:\users\user\appdata\local\programs\wolfervpn\wolfervpn.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\wolfervpn" --mojo-platform-channel-handle=2204 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WolferVPN" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1680 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe "C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WolferVPN" --mojo-platform-channel-handle=2204 --field-trial-handle=1684,i,1620382105047154044,16004179749874181730,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Programs VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Programs\WolferVPN VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Programs\WolferVPN\resources VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Programs\WolferVPN\resources\app.asar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Credentials VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds Cache VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\FontCache VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\GameDVR VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\input VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\InputPersonalization VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Internet Explorer VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\OneDrive VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\PenWorkspace VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\PlayReady VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\RMSLocalStorage VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\TokenBroker VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Vault VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows Sidebar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Credentials VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds Cache VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\FontCache VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\GameDVR VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\input VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\InputPersonalization VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Internet Explorer VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\OneDrive VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\PenWorkspace VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\PlayReady VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\RMSLocalStorage VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\TokenBroker VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Vault VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows Sidebar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\Downloads VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\Documents VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Credentials VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds Cache VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\FontCache VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\GameDVR VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\input VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\InputPersonalization VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Internet Explorer VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\OneDrive VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\PenWorkspace VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\PlayReady VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\RMSLocalStorage VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\TokenBroker VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Vault VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows Sidebar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.bby Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.bby Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data.bby Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.bby Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Jump to behavior
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Programs\WolferVPN\WolferVPN.exe Directory queried: C:\Users\user\Documents Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1352257 Sample: WolferVPN.exe Startdate: 02/12/2023 Architecture: WINDOWS Score: 68 52 rufflesrefined.com 2->52 56 Multi AV Scanner detection for domain / URL 2->56 58 Multi AV Scanner detection for dropped file 2->58 8 WolferVPN.exe 12 2->8         started        13 WolferVPN.exe 11 192 2->13         started        15 Updater.exe 2->15         started        signatures3 process4 dnsIp5 54 rufflesrefined.com 172.67.218.203, 443, 49720, 49721 CLOUDFLARENETUS United States 8->54 34 C:\Users\user\AppData\Roaming\...\Updater.exe, PE32+ 8->34 dropped 36 b1c3f10e-540e-46f8...879b20c9f6.tmp.node, PE32+ 8->36 dropped 38 C:\Users\user\AppData\...\Login Data.bby, SQLite 8->38 dropped 46 4 other files (3 malicious) 8->46 dropped 60 Drops PE files to the startup folder 8->60 62 Tries to harvest and steal browser information (history, passwords, etc) 8->62 64 Drops large PE files 8->64 17 WolferVPN.exe 1 8->17         started        20 cmd.exe 1 8->20         started        22 cmd.exe 8->22         started        24 WolferVPN.exe 1 8->24         started        40 C:\Users\user\AppData\Local\...\vulkan-1.dll, PE32+ 13->40 dropped 42 C:\Users\user\AppData\...\vk_swiftshader.dll, PE32+ 13->42 dropped 44 C:\Users\user\AppData\Local\...\libGLESv2.dll, PE32+ 13->44 dropped 48 16 other files (5 malicious) 13->48 dropped file6 signatures7 process8 dnsIp9 50 chrome.cloudflare-dns.com 172.64.41.3 CLOUDFLARENETUS United States 17->50 26 tasklist.exe 1 20->26         started        28 conhost.exe 20->28         started        30 tasklist.exe 1 22->30         started        32 conhost.exe 22->32         started        process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.218.203
 rufflesrefined.com United States
13335 CLOUDFLARENETUS false
172.64.41.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
rufflesrefined.com 172.67.218.203 true
chrome.cloudflare-dns.com 172.64.41.3 true